Missing support for `secret_token` webhook verification

[baseciq]

I’m using irazasyed/telegram-bot-sdk v3.15.0 and noticed that the SDK currently does not support the secret_token parameter introduced in the Telegram Bot API for webhook security.

According to the official Telegram documentation, secret_token can be set when configuring a webhook and is then sent with every webhook request in the X-Telegram-Bot-Api-Secret-Token header:

secret_token — Optional
A secret token to be sent in a header X-Telegram-Bot-Api-Secret-Token in every webhook request (1–256 characters, allowed characters: A-Z, a-z, 0-9, _ and -).
This header is useful to ensure that the request comes from a webhook set by you.

https://core.telegram.org/bots/api#setwebhook

Current limitation

At the moment:

• The SDK does not expose secret_token when calling setWebhook
• There is no built-in mechanism to automatically verify the X-Telegram-Bot-Api-Secret-Token header when handling webhook requests

Proposed improvement

It would be great if the SDK could:

1. Allow configuring a secret_token in the bot configuration
2. Automatically pass this token when calling setWebhook
3. Validate the incoming webhook request by comparing the X-Telegram-Bot-Api-Secret-Token header against the configured value during bot initialization or webhook handling

Benefits

• Improved webhook security
• Less boilerplate code in user applications
• Better alignment with the official Telegram Bot API

I’d be happy to help with testing or providing feedback if this feature is considered.

Thanks for the great SDK and for maintaining it!

[jonnywilliamson]

https://github.com/telegram-bot-sdk/telegram-bot-sdk

https://github.com/telegram-bot-sdk/telegram-bot-sdk/blob/0d387596c5becbe8a512b5832741218ec89d4152/src/Methods/GettingUpdates.php#L56

In v4 already

[kksandr7]

https://github.com/telegram-bot-sdk/telegram-bot-sdk

https://github.com/telegram-bot-sdk/telegram-bot-sdk/blob/0d387596c5becbe8a512b5832741218ec89d4152/src/Methods/GettingUpdates.php#L56

In v4 already

We can only set it by passing it to setWebhook, but getWebhookUpdate still does not automatically handle the X-Telegram-Bot-Api-Secret-Token header.

[jonnywilliamson]

Sorry it's in the laravel package:

https://github.com/telegram-bot-sdk/laravel/blob/c7166b3040a71d4f8dea57bbcf68cb270944a513/src/Http/Middleware/ValidateWebhook.php#L35