SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

How to accept Telegram Stars in a bot: the XTR payment flow

0
·3 views

Developers selling digital goods in Telegram bots and Mini Apps must use Telegram Stars, with the currency code XTR. The article describes a payment flow that starts by writing a pending order to the database and using its ID as the invoice payload. Invoices are created with sendInvoice in chats or createInvoiceLink in Mini Apps, using an empty provider token and a single whole-number Stars price. On receiving a pre_checkout_query, the server must validate the order within Telegram's 10-second window before any Stars move. The author stresses that a client-reported "paid" status should never grant an item without server-side confirmation, and that duplicate or unexpected charges must be detected and refunded.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Tailscale vs Headscale: Trade-offs of Self-Hosting a Mesh VPN Control Plane

A DEV Community guide compares the official Tailscale service with Headscale, an open-source, self-hosted replacement for its coordination server. It explains that Headscale only substitutes the control plane, so users still run the official Tailscale clients while peer-to-peer WireGuard tunnels remain unchanged. The article covers deployment needs such as a domain name, valid TLS certificates, a static IP or dynamic DNS, and a reverse proxy, and provides a sample Docker Compose setup. It also outlines how to point Linux and iOS clients at a custom login server and notes that Headscale has no built-in web interface, so administration is done via the command line. The author recommends the free Tailscale tier for most users, reserving Headscale for those who need full control over their network infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Synthetic identity fraud targets AI-driven customer onboarding at lenders and fintechs

Criminal rings are exploiting automated digital verification pipelines at credit unions, lenders, and fintechs by blending real Social Security numbers with AI-generated licenses, deepfake faces, and cultivated credit histories. Legacy KYC rules often fail to detect these hybrid fabrications, which do not trigger the immediate alerts that conventional identity theft does. Fraudsters build fabricated credit profiles over 12 to 24 months before draining multiple lending institutions at once, typically leaving write-offs and vanished perpetrators behind. Experts recommend stronger controls, including inspection of document artifacts, hardware-anchored biometric liveness checks, and multi-bureau credit cross-referencing. The article describes these attacks as an industrial-scale operation that uses commercial generative AI tools and camera emulation to bypass existing safeguards.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Exposed wg-easy admin panels pose outsized VPN risk despite small public footprint

Researchers found only three ZoomEye title matches for wg-easy, a small web interface for managing WireGuard, but warn that a low count does not mean low risk. The admin UI can create peers, manage keys, and retrieve VPN configuration, so a compromised session can grant network access without touching host firewalls. Documentation for a pre-release version reportedly assigns admin permissions to externally authenticated users, so operators should verify role behavior in the exact version they run. Recommended defenses include keeping the admin UI behind an independent authenticated access layer with MFA, restricting source networks, and isolating the Docker socket from the web container. Operators should also treat peer private keys as credentials, audit peers after any suspected admin compromise, and monitor logins, peer creation, and configuration downloads.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Globo Nordeste viewers see Mato Grosso morning show during December 2015 signal outage

On December 29, 2015, a signal failure at Globo Nordeste led to an unexpected broadcast swap. Instead of the Pernambuco-based Bom Dia morning program, viewers were shown Bom Dia Mato Grosso, aired by TVCA. The change happened because most of the network's equipment had been damaged. The incident was reported after it circulated as a tweet that captured the mix-up.

0 comments Read more at DEV Community