How to Get Your Telegram api_id and api_hash

Your Telegram api_id and api_hash come from Telegram, not from TelegramBuddy. Log in at my.telegram.org with your phone number, open API development tools, fill in a short form describing the app you are using, and the page hands you two things: a number called the api_id and a 32-character string called the api_hash. Paste both into TelegramBuddy’s first-run screen and that is the setup done. The values are saved on your own computer, and you will not be asked for them again.

That is the short answer. The rest of this page explains what those two values are, what they are not, why an app cannot simply arrive with a pair already filled in, and what to do if the form on Telegram’s site gives you trouble.

What the api_id and api_hash actually are

Telegram publishes an API: a documented set of instructions that lets other programs talk to its network directly, the same way the official apps do. Anyone writing such a program has to register it once. Registration produces a pair of values that travel with every request the program makes, so Telegram can tell which piece of software is on the other end of the line.

That is all they are. They identify the application, not you. Your name, your chats and your contacts are not in them, and they are not a licence, a subscription or anything you pay for.

It is worth being precise about what they are not:

• Not your Telegram password. Nobody can read your messages with an api_id and api_hash alone. Signing in to your account is a separate step, described further down.
• Not a bot token. A bot is its own account with its own separate set of chats. TelegramBuddy is not a bot; it signs in as you and therefore sees exactly the chats you already see.
• Not issued by TelegramBuddy. There is no TelegramBuddy account and no TelegramBuddy server, so there is nothing on our side that could hand you a pair or keep a copy of yours.

How to get your Telegram api_id and api_hash

The whole process happens on Telegram’s own website and takes a couple of minutes.

1. Open my.telegram.org in any browser.
2. Type your phone number in international format, starting with a + and your country code.
3. Telegram sends a login code as a message inside Telegram itself, not as an SMS. Open Telegram on your phone or desktop, read the code, and enter it on the page.
4. On the page that appears, click API development tools.
5. Fill in the short form (the fields are explained below) and submit it.
6. The page now shows App api_id and App api_hash. Nobody reviews or approves anything; the values exist as soon as the form is submitted.
7. Copy both into TelegramBuddy’s first-run screen. If you close the tab too early, returning to API development tools shows you the same pair again.

Filling in the form

The form is asking about an app, which feels odd when you are only trying to use one. Nothing here is checked against anything, so plain and honest answers are fine:

• App title and Short name — anything you will recognise later, such as My Downloader. The short name wants letters and numbers without spaces.
• URL — optional. Leave it empty.
• Platform — choose Desktop.
• Description — optional. A few words, or nothing at all.

api_id, account login and bot token: the differences

These three get confused constantly, and mixing them up is the usual reason a setup screen refuses to move on.

	What it identifies	Where it comes from	If someone else gets it
api_id and api_hash	The software making requests	my.telegram.org, once, free	They can make requests that count against your rate limits
Your Telegram login	You, the account holder	A QR code or a code sent to your Telegram	They could read your chats, so this one matters most
A bot token	A separate bot account	Telegram’s BotFather	They control that bot, which is not your account

Why every install should have its own pair

Telegram counts rate limits against the api_id. When a program asks for too much too quickly, Telegram replies with a flood wait — a pause of a few seconds to a few minutes before it will answer again — and that pause is attached to the id that made the requests.

Share one api_id across thousands of installs and everybody’s traffic lands in the same bucket: one person pulling a decade of video slows down everyone else, and a single restricted id would take every install down with it. Your own pair keeps your limits yours. It is two minutes of work, once, in exchange for not being affected by strangers. The download page puts the same reasoning more briefly.

Flood waits are normal and expected, not a sign that something has broken. TelegramBuddy waits them out and carries on by itself, which is also why a long bulk download can be left alone; resuming interrupted downloads goes into what happens when a transfer stops for other reasons.

If you use TelegramBuddy on two computers, giving each one its own pair keeps their limits from overlapping.

Keeping the two values private

Treat the api_hash the way you would treat any key. Do not post it in a forum thread, a bug report or a public code repository, and crop or blur it before sharing a screenshot of the setup screen. The api_id is a short number and much less sensitive, but there is no reason to publish either.

If a pair does leak, the damage is limited and indirect: someone else’s requests would count against your rate limits, which means slower downloads for you. They still could not touch your messages without your account login. You can create a fresh pair at my.telegram.org and enter that instead.

On your own machine the values sit in TelegramBuddy’s settings, and they are not sent anywhere except to Telegram, as part of the requests they exist to identify.

Signing in to your account is a separate step

After the credentials are in place, TelegramBuddy asks you to sign in to your own Telegram, either by scanning a QR code with your phone or by entering your phone number and the code Telegram sends you. That login becomes a session file on your computer. It is never uploaded anywhere, because there is nowhere to upload it to: the app talks straight to Telegram and writes downloaded files straight to your disk.

So the two halves of setup do different jobs. The api_id and api_hash say which program is calling. The login says on whose behalf. Neither one gives anybody else access to the other, and the FAQ answers the rest of the privacy questions that usually follow.

If the form gives you trouble

• The page shows an error when you submit. Wait a while and try again, ideally in a private window or a different browser, with any ad blocker or script blocker paused for the site.
• No login code arrives. Look inside Telegram rather than in your SMS inbox. The code is delivered as a message from Telegram in the app.
• The app says the credentials are wrong. Check for a stray space at the start or end of either value. The api_id is digits only. The api_hash is exactly 32 characters of letters and numbers.
• You cannot find where the values went. Open API development tools again on my.telegram.org; the app you registered is still there with its pair.

Next steps

With the credentials entered and your account signed in, the app can open any chat you are a member of, including private channels and groups reached through an invite link. From there you can browse the full history, pull media in bulk, or export a chat’s messages to HTML or JSON. A tour of what the app does is on the features page. One thing worth saying plainly: the app will happily save whatever you can see, so keep only what you have the right to keep.