CURRICULUM STEP 064 / 100 Module 06: Supergroups, Forum Topics, Admin Permissions & Moderation

← Prev: Step 063 All Curriculum Next: Step 065 →

Step 063: Anonymous Admin Mode [Done 🟢] Step 064: Join Requests & CAPTCHA Step 065: Public vs Private Links

[Telegram 164] Join Requests & CAPTCHA Gateways: Zero-Trust Perimeter Defense & Screening Pipelines

In open-access communities, the easiest entry point for bad actors is direct link joining: an automated userbot clicks an invite link, immediately joins the member list, and broadcasts mass scam spam before human moderators can react. Telegram disrupted this vulnerability by introducing Admin Approval Join Requests. By transforming group invite links into zero-trust quarantine gates, prospective members must submit an entry request before accessing the chat stream. When combined with automated verification bots and onboarding questionnaires, community architects can filter out 100% of automated scrapers and Sybil networks. This guide deconstructs the MTProto join request lifecycle, webhook event architectures, and CAPTCHA automation strategies.

Executive Summary: Zero-Trust Perimeter Architecture

Pre-Admission Quarantine: Enabling Request Admin Approval prevents users from immediately seeing chat messages or obtaining member status upon clicking an invite link.
Automated Bot Webhook Hooks: When a user submits a join request, Telegram emits a chat_join_request update, allowing verification bots to message the applicant directly via private chat with interactive CAPTCHAs.
Custom Questionnaire Integration: Premium communities can require applicants to answer screening questions or verify Web3 wallet balances prior to admission approval.
Bulk Triage & Expiration: Group administrators can review candidate profiles, bios, and mutual group history in a dedicated review queue, approving or declining individuals or batch-admitting verified users.

1. Technical Anatomy: How MTProto Handles Join Requests

Traditional invite links execute messages.importChatInvite, which writes the user directly to the channel participants database. When “Request Admin Approval” is active, the protocol diverts the flow:

Phase 01

Pending Quarantine Queue

The server creates a pending record in the group's join request table. The applicant cannot read group history, cannot see member lists, and cannot send messages.

Phase 02

Bot Gateway Dispatch

The Telegram Bot API broadcasts an updateChatJoinRequest webhook to authorized bot tokens. The bot initiates a private 1-on-1 dialogue with the user to solve a challenge.

Phase 03

Cryptographic Admission

Upon verification, the bot invokes messages.hideChatJoinRequest(approved=true). The user is atomically upgraded to full participant status with zero delay.

2. Bot API Architecture: Handling `ChatJoinRequest`

Developers building custom onboarding gates utilize Telegram Bot API 5.5+ methods. The webhook payload contains full metadata on the applicant:

// Telegram Bot API Webhook Payload: ChatJoinRequest
{
  "update_id": 92837192,
  "chat_join_request": {
    "chat": { "id": -1001849204820, "title": "TGWAY Tech Forum", "type": "supergroup" },
    "from": { "id": 502847291, "is_bot": false, "first_name": "Clara", "username": "clara_dev" },
    "user_chat_id": 502847291,
    "date": 1789132650,
    "invite_link": {
      "invite_link": "https://t.me/+AbCdEfGhIjKl",
      "creator": { "id": 108420194, "is_bot": false, "first_name": "Founder" },
      "creates_join_request": true
    }
  }
}
    

3. Step-by-Step Configuration: Creating Join-Request Links

Follow this operational checklist to generate gated invite links in any Supergroup or Channel:

Navigate to Invite Links

Open Group Info → Edit → Invite Links → Tap Create a New Link.

Toggle “Request Admin Approval”

Switch the Request Admin Approval toggle to the ON position. Optionally assign an internal reference label (e.g. “Twitter Campaign”) to track traffic sources.

Provision Bot Approval Privileges

If using an automated screening bot (e.g., Gatekeeper Bot), promote the bot to Administrator with the permission Invite Users via Link. This allows the bot to approve passing candidates autonomously.

4. Interactive Lab: Join Requests & CAPTCHA Perimeter Defense Simulator

Experience an enterprise join request triage pipeline. Switch between Manual Admin Review and Automated Bot CAPTCHA mode, test incoming applicant profiles, and execute real-time admission decisions.

Perimeter Defense Mode

Spam Infiltration

0.0%

Quarantine Queue

3 Pending

Quarantine Chamber (Pending Applicants)

Applicant Dossier

Click any candidate on the left to inspect profile history and questionnaire answers.

MTProto API Telemetry: messages.hideChatJoinRequest STATUS: LISTENING

{
  "_": "messages.hideChatJoinRequest",
  "peer": { "_": "inputPeerChannel", "channel_id": 1849204820, "access_hash": 948275928174 },
  "user_id": { "_": "inputUser", "user_id": 502847291, "access_hash": 394857291847 },
  "approved": true
}

5. Telegram Join Requests & CAPTCHA Architecture Blueprint

The technical diagram below illustrates the complete applicant lifecycle from invite link click through the quarantine waiting room to automated challenge resolution:

Telegram Join Requests Architecture Blueprint Infographic

⌖ Click to Enlarge Infographic Blueprint (2:3 High-Res Technical Diagram)

6. Hardening Recommendations: Sybil Infiltration Defense

Deploying Join Requests completely eliminates drive-by automated spam attacks. Follow these tactical hardening principles:

Perimeter Hardening Rules:

Disable Permanent Public Invites: Revoke default unmonitored t.me/+... links; ensure all published invite links enforce “Request Admin Approval”.
Enforce 60-Second Challenge Timers: When configuring verification bots, set short response windows. Human users solve emoji or math CAPTCHAs in 5 seconds, whereas dormant userbot farms time out.

7. Frequently Asked Questions (FAQ)

Can a user re-apply if their Join Request is declined?

If an admin simply declines the request, the user can tap the invite link again to submit a new request. However, if the admin selects “Decline and Block”, the user is permanently barred from applying.

Do Join Requests work for Public Supergroups with an @username?

If a supergroup has a public username (e.g. t.me/tgway), anyone can join directly via the public handle. To enforce join requests globally, the group must remove the public username or require approval on all specific invitation campaigns.

Can multiple administrators approve join requests simultaneously?

Yes. Any administrator possessing the “Invite Users via Link” privilege can review the queue and approve or dismiss candidates. Actions are synchronized across all devices in real time.

← Prev: Step 063: Anonymous Admin Mode Back to Basics Index Next: Step 065: Public vs Private Links →