Bot and automation glossary

Allow list: An explicit list of permitted values (commands, domains, user IDs). Safer than trying to block every bad value.
App-level token: A Slack token (xapp-) that represents the app itself, used to open Socket Mode connections.
At-least-once delivery: A guarantee that an event will be delivered, possibly more than once. Requires idempotent handlers.
Backoff: Waiting longer between successive retries, usually exponentially, to give an overloaded service time to recover.
Bot token: The credential that authenticates a bot to a platform API. Equivalent to a password for the bot account.
BotFather: The official Telegram bot used to create bots and manage their settings.
Callback query: The Telegram update sent when a user presses an inline keyboard button with callback_data.
Circuit breaker: A pattern that stops calling a failing dependency for a while instead of piling up requests.
Cron expression: Five fields (minute, hour, day of month, month, day of week) that describe a recurring schedule. Build one with the cron builder.
Dead-letter queue: A queue where messages go after repeated processing failures, so they can be inspected without blocking others.
Deferred response: An initial acknowledgment to a Discord interaction (type 5) that buys up to 15 minutes to send the real reply.
Embed: A rich message card on Discord with title, description, fields, images and color.
Embedding: A numeric vector that represents the meaning of text, used for semantic search and retrieval.
Ephemeral message: A message visible only to the user who triggered it (Discord, Slack).
Gateway: Discord's WebSocket API that streams real-time events to connected bots.
HMAC: Hash-based message authentication code: a keyed hash used to sign webhook payloads with a shared secret.
Idempotency: The property that performing an operation several times has the same effect as performing it once.
Idempotency key: A unique value sent with a request so the server can recognize and ignore retries.
Inline keyboard: Buttons attached to a Telegram message that open URLs or send callback queries.
Intents: Discord Gateway event groups a bot subscribes to. Some are privileged and require approval.
Interaction: A Discord event triggered by a user using a slash command, button, select menu or modal.
Jitter: Random variation added to retry delays so many clients do not retry at the same moment.
JWT: JSON Web Token: a signed, base64url-encoded set of claims. Decoding is not the same as verifying.
Long polling: Requesting new events with a request that the server holds open until events arrive or a timeout passes.
MCP (Model Context Protocol): An open protocol that lets AI applications discover and call tools and resources exposed by servers.
Mini App: A web application that opens inside Telegram and can exchange data with a bot.
OAuth2 scope: A named permission requested when installing an app (for example Slack chat:write).
Opt-in: A user's explicit consent to receive messages. Required for business-initiated WhatsApp messages.
Privacy mode: Telegram's group setting that limits which messages a bot receives.
Prompt injection: Text that tries to override an AI model's instructions, delivered directly by a user or hidden in content the model reads.
Rate limit: A cap on how many requests a client may make in a period. Exceeding it returns HTTP 429.
RAG (retrieval-augmented generation): Retrieving relevant documents and adding them to a model prompt so answers are grounded in your data.
Replay attack: Re-sending a captured valid request. Prevented with timestamps, nonces and short validity windows.
robots.txt: A file that tells crawlers which paths to avoid, standardized in RFC 9309.
Secret token (Telegram): A value you set with setWebhook that Telegram sends in the X-Telegram-Bot-Api-Secret-Token header.
Signing secret: A shared secret used by a platform (such as Slack) to sign requests to your app.
Slash command: A command beginning with / that a chat platform routes to an app with structured options.
Socket Mode: Slack's WebSocket connection mode, which removes the need for a public Request URL.
SSRF: Server-side request forgery: tricking a server into fetching internal or unintended URLs.
Template message: A pre-approved WhatsApp message format that can be sent outside the 24-hour window.
Token bucket: A rate-limiting algorithm that allows bursts up to a capacity while enforcing an average rate.
Tool calling: A model capability to request execution of functions you define, with JSON arguments.
Update: A Telegram event object with an increasing update_id.
Webhook: An HTTP request sent by a service to your URL when an event occurs.