Account security
How to protect your account, bots, and money.
Your MGRAM account is tied to Telegram, so its security is above all the security of your Telegram and your bots.
Main rules
- Never share Telegram codes or your two-step verification password. MGRAM never asks for them.
- Give your bot token only to @mgram_robot. MGRAM staff never ask for tokens in private messages.
- Keep API keys on your server. Don't publish them in website or Mini App code or in public repositories.
- Top up only via the “Top up” button in the bot. Payment details from other chats are a scam.
- Check addresses: the official bot is @mgram_robot, the website is mgram.biz. See Official links.
Turn on two-step verification in Telegram
Telegram → “Settings” → “Privacy and Security” → “Two-Step Verification”. Then nobody can log into your account even with the SMS code.
If your bot token leaked
- In @BotFather choose the bot and reissue the token — the old one stops working.
- In @mgram_robot open the bot and tap “Update token”.
- Send the new token of the same bot.
If an API key leaked
Open the bot card → “Settings” → “API key” → “Rotate API”. The old key stops working immediately — remember to replace it on your server.
Website login
On mgram.biz, login is confirmed through Telegram. If you get a login confirmation but didn't click anything, don't confirm it.
Money
- Check the address before withdrawing USDT: blockchain transfers are irreversible.
- Transfers to other users can't be undone — check the Telegram ID.
- Suspicious operations in “Transactions” — contact Support right away.
Privacy
In “My profile” → “Settings” you can make your profile private — then you won't be shown as the owner in your bots' cards.