BotPanel

BotPanel is a self-hosted Telegram bot admin panel that runs entirely on Cloudflare Workers, storing all state in a single Durable Object backed by SQLite, so no rented server, Docker, separate database or static IP is required.

What is BotPanel?

BotPanel is a full admin panel for Telegram bots deployed to Cloudflare Workers. You give it a BotFather token, a webhook secret and a Cloudflare account; the Worker itself serves the admin UI, the Telegram webhook endpoint, a customer-facing mini-app at /portal, subscription links at /sub/<token> and /sub-all/<token>, and payment callback routes under /pay/. The project is authored by aMirsEdighian and is currently at version 3.6, which added Remnawave, Rebecca and TonPay/BluPal/QubePay/Tronado gateway connections in VPN sales.

Key Features

• Cloudflare Workers stack — Hono routing under /api, Durable Object class BotCoordinator with SQLite storage, an optional legacy BOT_KV namespace for reading old data, a per-minute Cron trigger for queued sends and renewals, and locally built Tailwind assets so the panel loads without external CDNs.
• Bot studio with bot-type presets — pick shop, service/VPN, channel, group manager, Q&A, education, nationwide news, rates/currency or fully custom; only relevant tabs appear and existing data is preserved.
• Store module — product catalog with categories, bilingual descriptions, atomic stock locking, /search product lookup, cart with quantity edits, percentage or fixed discount codes, loyalty-point redemption, Zarinpal/Telegram Stars/crypto checkout, and card-to-card receipt upload with an admin approval queue.
• VPN/service module — 13 tabs covering Marzban, Marzneshin, PasarGuard and stock providers, plans with extra-GB/extra-day pricing, prepaid config shelves with bulk paste, wallet balances, manual renewals, suspend/activate, and an operations log with automatic reconcile so a lost provider response does not create duplicate accounts.
• Live rates bot — gold, coin, free-market currency and crypto prices from layered Iranian and global sources with one-minute caching, riyal/toman normalization, per-source status at /api/rates/sources, and scheduled daily publication to channels.
• Nationwide news bot — Iranian feeds (IRNA, ISNA, Mehr, Tasnim, Tabnak) and international sources with automatic Persian translation, 30-day translation cache, daily-time or 10–1440-minute interval publishing, and duplicate suppression.
• Group manager (13 capabilities) — media locks across 11 content types, welcome messages with {name}/{id}/{time} variables, word blacklist, warn/mute/ban ladder commands, canned responses, night mode on Asia/Tehran, captcha-on-join, and cryptographically secure raffles.
• Admin mini-app and webhook management — /admin in Telegram mirrors the web panel (news, rates, forward-removal, menu buttons), admin auth inside Telegram uses Telegram.WebApp.initData with HMAC-SHA256, and the panel warns until the webhook is registered.

Who is it for?

• Telegram bot operators selling digital goods — run a catalog, discounts and card-to-card verification without renting a VPS.
• VPN resellers — connect Marzban-family panels or a prepaid config shelf and sell, renew and track subscriptions from one dashboard.
• Channel and group admins — automate antispam, forced-join, captcha and welcome flows, and schedule news or price tables to channels.
• Developers — fork the JavaScript codebase (src/index.js, src/telegram.js, src/services/, public/), run npm run dev on port 8787, and deploy with npm run deploy.

How does BotPanel work?

1. Create a bot in BotFather, clone the repo, run npm ci and npm run build, then npx wrangler login with Node.js 22.16 or newer.
2. Set WEBHOOK_SECRET (a 32-character random string is required) and optionally BOT_TOKEN, VAULT_KEY, ADMIN_PASSWORD and BACKUP_PASSWORD via wrangler secret put, then run npm run deploy.
3. Open the Worker URL, log in with the default password botpanel123, and immediately set a private password; the default-password session cannot reach any other section.
4. Save the bot token, your numeric admin ID and press register webhook, then send /start from a test account.

FAQ

Is BotPanel free?

The page does not state a license or price for the code itself. Running it requires a Cloudflare account with Workers and Durable Objects access, and the optional VPN, payment-gateway and media-channel integrations depend on your own third-party accounts.

Which VPN panels can BotPanel connect to?

BotPanel supports Marzban, Marzneshin and PasarGuard through the standard Marzban-family API, including service groups, plus a manual stock shelf for pre-made configs. Provider credentials are encrypted with the VAULT_KEY secret (32 characters) and are not returned by the API after saving.

What are the file upload limits?

Direct media upload sends files through a chosen admin chat or a dedicated channel/group, with a limit of 10 MB for images and 20 MB for other files. Changing the bot token requires re-uploading all media because stored file_id values become invalid.

Can one panel manage multiple bots?

Yes. Each bot added under "My Bots" gets its own Durable Object, so users, products, settings and menu buttons stay isolated; webhooks are registered per bot at /bots/<BOT_ID>/telegram/webhook and the menu editor switches to the selected bot automatically.

Are there known limitations?

Yes. Each Telegram token supports only one active webhook, so registering here disconnects any previous service using the same token. The panel session is held in sessionStorage, so a new tab or browser restart requires the password again, while admin login inside Telegram needs no password.