Building a Telegram Group Join Bot with Muse and OIDC

Introduction

The currently popular muse is an Agent. Moreover, it comes "fully furnished": utilities and the network are connected, and the furniture and appliances are all in place. You don't need to install a system or configure a model; you can start chatting right away.

All the examples in my blog about developing for Agents and putting Agents to work can be copied over to muse and tried there.


In Practice

Give muse the key points summarized in my previous post about a Telegram group-join verification bot and have it build the system from scratch. 

Develop a Telegram group-join verification system deployed on Cloudflare worker 

Based on Cloudflare worker; do not use KV.
Split the muting and unmuting operations into two workers.

Workflow:
1. A new member joins the group,
2. worker-a uses bot-admin to mute the new member and sends a group message containing a human-verification link. The link points to worker-b and carries the user's user_id and the group's chat_id.
3. The user visits worker-b through the human-verification link.
4. worker-b invokes Turnstile for human verification.
5. After the user passes human verification, worker-b uses the user_id and chat_id information carried in the link to have bot-admin remove the member's messaging restriction.

Additional requirements:
The message in step 2 must use Ephemeral Messages (visible only to the designated user).
The human-verification flow in step 4 must also include a telegram login step to confirm that the person completing the verification also controls the muted telegram account.

Exception handling:
There is a whitelist of work groups. If worker-a receives a message pushed by the telegram server and finds that the group's chat_id is not on the whitelist, the bot should leave the group.

Then muse finished developing it in just four minutes.

muse replies after completing development: code is in ~/workspace/tg-group-verify/, and both workers are single-file, dependency-free, and KV-free


I want you to help me manage my cloudflare account
Learn the Cloudflare CLI cf tool  https://developers.cloudflare.com/cf/

Chat log showing muse learning the Cloudflare CLI cf tool and completing OAuth authorization, then replying that login succeeded, the account has 7 workers, and asking whether to deploy the group-verification system


Deploy the group-join verification system you just developed to cloudflare. 

Chat log requesting that muse deploy the group-verification system to cloudflare, with a reply listing configuration items such as BOT_TOKEN and Turnstile key and the cf workers secrets command

Deployment configuration checklist from muse: masked BOT_TOKEN and TG_CLIENT_SECRET, plus BotFather Login Widget, Turnstile, callback URL, and steps to add the bot to the group and grant it administrator permissions

During the process above, I asked the web version of deepseek about the steps for having botfather set up OIDC login.

Telegram screen showing BotFather open to the 防广告-2 bot, with Login Widget highlighted by an orange box in the Settings list on the right
BotFather settings page for the 防广告-2 bot, with the Login Widget entry in the Settings list highlighted by an orange box
BotFather Login Widget instructions page showing that users can log in to websites with a Telegram account, plus an Enter URL input field and a Switch to OpenID Connect Login button
OIDC configuration page with the callback URL filled in: Redirect URLs is the worker's /auth/callback, and Trusted Origins is the worker root URL

The End

I tested it in practice.

The advantage of using OIDC to log in to  telegram is that you can invoke the telegram APP for verification.

The downside is that when logging in with a specified phone number, telegram said it had sent me a message, but I never actually received it.


Github

https://github.com/crazypeace/tg-join-group-exam-bot-worker-turnstile-by-muse

The code muse wrote has also been uploaded to Gitbub; if you're interested, you can compare it.


Comments