The data behind your Solana Telegram bot

Show me

Event to Telegram message

Four pieces: one registration, the signed POST you receive, a handler that verifies and deduplicates, and a plain Bot API call. Header names, payload keys and the signature scheme are the code's; values are illustrative.

1. 1 · Register

   Pick the events and a delivery filter. The response returns the webhook's secret once; store it with your bot token.

   Register the webhook once

   POST /api/v1/webhooks
   Authorization: Bearer msk_...
   Content-Type: application/json
   
   {
     "url": "https://bot.example.com/madeonsol",
     "events": ["wallet_tracker:event", "deployer:alert"],
     "filters": { "deployer_tier": ["elite"] }
   }

2. 2 · Receive

   Each event arrives as one HTTPS POST: an envelope of event, data and timestamp, signed in the headers.

   What MadeOnSol POSTs to your backend

   POST /madeonsol
   Content-Type: application/json
   X-MadeOnSol-Timestamp: 1790157600421
   X-MadeOnSol-Signature: 3b9f...c7a2
   X-MadeOnSol-Event: wallet_tracker:event
   User-Agent: MadeOnSol-Webhook/1.0
   
   {
     "event": "wallet_tracker:event",
     "data": {
       "subscriber": "<your user id>",
       "wallet_address": "7xKX...3bPq",
       "label": "whale #1",
       "event_type": "swap",
       "action": "buy",
       "token_mint": "8vdc...pump",
       "sol_amount": 2.5,
       "token_amount": 1000000,
       "counterparty": null,
       "tx_signature": "5Hyj...kMnP",
       "block_time": 1790157600,
       "slot": 449476673,
       "replayed": false,
       "ts": "2026-09-23T10:00:00.000Z"
     },
     "timestamp": "2026-09-23T10:00:00.418Z"
   }

3. 3 · Verify and dedupe

   Check the HMAC over the raw body, answer fast, then drop anything you have already sent.

   Your handler: verify, acknowledge, dedupe

   import crypto from "node:crypto";
   import express from "express";
   
   const app = express();
   const seen = new Set<string>(); // use Redis or a unique DB column in production
   
   app.post("/madeonsol", express.raw({ type: "application/json" }), (req, res) => {
     const ts = req.get("X-MadeOnSol-Timestamp") ?? "";
     const sig = req.get("X-MadeOnSol-Signature") ?? "";
     const expected = crypto
       .createHmac("sha256", process.env.MADEONSOL_WEBHOOK_SECRET!)
       .update(`${ts}.${req.body}`) // the raw body, never re-serialized JSON
       .digest("hex");
     const fresh = Math.abs(Date.now() - Number(ts)) < 5 * 60_000;
     if (!fresh || sig.length !== expected.length ||
         !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
       return res.sendStatus(401);
     }
   
     res.sendStatus(200); // answer inside the 10 s delivery timeout, then work
   
     const { event, data } = JSON.parse(req.body.toString("utf8"));
     // The envelope has no event id: key on the payload's own identity.
     const key = event === "deployer:alert"
       ? `deployer:alert:${data.alert_id}`
       : `${event}:${data.tx_signature}:${data.wallet_address}`;
     if (seen.has(key)) return;
     seen.add(key);
     sendAlert(event, data).catch(console.error);
   });

4. 4 · Send

   Format the fields you care about and call sendMessage. This is the whole Telegram side.

   Telegram: one sendMessage call

   // Token symbols and labels are free text: escape them for parse_mode HTML.
   const esc = (s: unknown) =>
     String(s ?? "").replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c]!);
   
   async function sendAlert(event: string, d: Record<string, any>) {
     const text = event === "deployer:alert"
       ? `<b>${esc(d.deployer_tier)} deployer</b> launched <b>${esc(d.token_symbol)}</b>\n<code>${esc(d.token_mint)}</code>`
       : `<b>${esc(d.label ?? d.wallet_address)}</b> ${esc(d.action ?? d.event_type)} ${esc(d.sol_amount)} SOL` +
         (d.replayed ? " (recovered)" : "") +
         `\n<code>${esc(d.token_mint ?? d.tx_signature)}</code>`;
   
     // Standard Telegram Bot API from here on: nothing MadeOnSol-specific.
     const r = await fetch(`https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/sendMessage`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ chat_id: process.env.TELEGRAM_CHAT_ID, text, parse_mode: "HTML" }),
     });
     if (!r.ok) throw new Error(`Telegram ${r.status}`); // on 429, wait retry_after and resend
   }

Architecture rule

Keep Telegram as the presentation layer

The bot process formats and sends. Everything below belongs to the layer behind it, and each rule comes from how delivery actually behaves.

• Avoid: Decode transactions or hold an RPC subscription

  Instead: Receive parsed events. A wallet_tracker:event already says swap or transfer, buy or sell, which token and how much SOL.

  • event_type
  • action
  • token_mint
  • sol_amount

• Avoid: Poll the REST feeds for new alerts

  Instead: Let webhooks push each event. On a Free key the KOL feed and deployer alerts are 5 minutes delayed, so a polling alert bot on Free is late by design.

• Avoid: Call Telegram inside the webhook request

  Instead: Answer 2xx first, then send. MadeOnSol waits 10 seconds per attempt, retries 5xx and 429, does not retry other 4xx, and pauses a webhook after 10 failed deliveries in a row.

• Avoid: Add the same wallet once per chat

  Instead: Watch each address once and keep the chat-to-wallet mapping in your own database. Every event carries your label; watchlist size depends on your plan.

  • label
  • wallet_address

• Avoid: Post a recovered event as if it just happened

  Instead: Check replayed. It is true when the tracker recovered the event after a reconnect; mark it in the message or skip it.

  • replayed
  • slot

• Avoid: Treat webhook delivery as your only record

  Instead: Nothing is queued while your endpoint or a paused webhook is down. After downtime, backfill from REST, for example /api/v1/wallet-tracker/trades.

Use cases

Alerts a bot can post, and where they come from

The same event reaches you as a webhook or on the WebSocket stream; the plan column shows the first plan for each. Watchlist setup in the Wallet Tracker API

Command bots and prototypes over RESTFree

Lookups right away; the KOL feed and deployer alerts 5 minutes delayed. No webhooks or WebSocket streams.

Alerts pushed to your backendFrom Pro

Signed webhooks for all 9 registry events, including the wallet tracker watchlist.

One long-running socket instead of webhooksFrom Pro

kol:trades, deployer:alerts, token:surges and copytrade:signals on one stream; wallet_tracker:events from Ultra.

A bot other people useBusiness

The embed licence covers one product including its companion bot, with a visible Powered by MadeOnSol notice.

Architecture

From chain event to chat message

Your bot keeps the Telegram token and the chat mapping; MadeOnSol keeps the watching and the parsing.

1. 1 · Source

   Chain activity

   Transactions and program events

3. 2 · MadeOnSol

   Data and intelligence layer

   • Wallet, KOL and deployer events
   • Token surge and risk context
   • Signed delivery with retries

5. 3 · Delivery

   • Webhookssigned HTTPS push
   • WebSocket streams/ws/v1/stream
   • REST APIlookups and backfill

7. 4 · Yours

   Your webhook handler and send queue

   Keys and business logic stay server-side

9. 5 · Users

   Your Telegram bot and chats

• Wallet alert bots
• KOL trade alert channels
• Launch alerts for tracked deployers
• Token surge alert groups
• Scanner bots for new deploys
• Rug-check command bots

A bot that posts MadeOnSol data into other people's chats displays it to your users, which requires a Business plan. See pricing