General
Is building a bot legal?
Yes. Bots are a normal, supported feature of Telegram, Discord, Slack, WhatsApp and countless APIs. What can be illegal or against the rules is what a bot does: spamming, impersonation, collecting personal data without a lawful basis, or accessing systems without authorization. Use official APIs, get consent and follow each platform's terms.
Is a "botnet" the same thing as a bot network?
No. A malicious botnet is a set of compromised devices controlled without their owners' consent. This site is about legitimate bots: software that people choose to install or talk to, run by an accountable operator. We do not cover malware, spam tooling or evasion techniques.
Which platform should I start with?
Telegram is the quickest: create a bot with BotFather and test from your phone in minutes. Discord is a great second step to learn slash commands and permissions. See getting started.
Do I need to know how to code?
Not always. Workflow tools such as n8n, Zapier and Make connect triggers and actions visually, and many have AI steps. You will eventually want some code for complex logic. See automation workflows.
Building and hosting
Should I use polling or webhooks?
Polling is easiest for development and works without a public URL. Webhooks are more efficient and are required for serverless hosting. Many teams poll locally and use webhooks in production.
Can I host a bot for free?
Often yes. Webhook bots fit comfortably in the free tiers of serverless platforms such as Cloudflare Workers. Always-on bots (Discord Gateway, long polling) need a small VPS or a PaaS worker, which usually costs a few dollars a month. See hosting bots.
Why does Discord say "The application did not respond"?
Your bot did not answer the interaction within 3 seconds. Defer the reply first, then edit it when your work is done. See Discord bots.
Why does my webhook signature check fail?
Almost always because the body was parsed and re-serialized before verification. Verify the raw bytes exactly as received, with the right secret and signing scheme. Debug with the webhook tester.
Security
Where should I keep my bot token?
In a secret manager or environment variables injected at deploy time, never in code, images or client-side scripts. If a token leaks, revoke it immediately. See bot security.
Are the tools on this site safe for real tokens?
They run entirely in your browser and do not send data to any server. The Telegram builder only contacts api.telegram.org if you explicitly press Send. Still, prefer test tokens when you can and rotate any credential you are unsure about.
AI, WhatsApp and scraping
How do I stop my AI bot from being manipulated?
You cannot fully prevent prompt injection, so limit what a manipulated model can do: enforce permissions in code, require confirmation for consequential actions and keep secrets out of prompts. See AI chatbots and agents.
How much does the WhatsApp Cloud API cost?
Meta charges per delivered template message, with prices by category (marketing, utility, authentication) and recipient country. Replies within the 24-hour customer service window are handled differently. Check Meta's current pricing before planning volume. See WhatsApp Cloud API.
Is web scraping allowed?
Fetching public pages politely is common, but terms of service, copyright and privacy laws apply, and bypassing logins or technical barriers is off limits. Prefer official APIs. See web scraping ethics.