Skip to content
Open Net Worth Docs

Telegram

Telegram is the one chat app this instance can talk through today — set it up once and message Lucius from your phone the same way you would from the web app, confirm cards included.

How it connects

The bot connects outward to Telegram and holds that connection open (long polling) — no need to be reachable from the internet, no webhook to expose. The bot token authenticates it; get one from Telegram’s BotFather the normal way.

Who’s allowed to message it

A fresh install allows no one — add each chat id explicitly. Message the bot /id to find your own. Any id not on the list is ignored; nothing further to configure to keep a stranger who finds your bot’s username from talking to it.

Once on the allowlist, a chat id is treated as you — the same trust as the web app, no separate “trust this sender” step. It’s your own bot, gated by a list only you control, not a public inbox strangers can reach.

Confirm cards on Telegram

A card appears as buttons under the message and works exactly as in Confirm cards: the same Allow once / Always allow / Deny, running exactly what was staged regardless of what anyone types in between.

One extra guard: a card is bound to the chat it was raised in — a tap arriving from a different chat does nothing, and the card stays live for the chat that received it. This check is per chat, not per individual sender within it: if more than one person shares an allowlisted chat, any of them can tap a card raised there, the same as any of them could already type a message into it.

Credentials

Your bot token is stored on this machine, never sent to Lucius or included in an export. The field doesn’t display it by default, but you (the operator) can reveal it to confirm what’s saved — logged, and the only way it’s ever shown to anyone. Excluded from a sanitised backup like every other connector credential; see Backup and restore.

  • lucius/confirm-cards — what a card looks like, on any surface
  • connectors/email-ingestion — the other read-oriented connector
  • operations/security-and-privacy — what’s stored, and where