--- title: "Selling GitHub Repo Access for Telegram Stars: The Payment Rail with No Bank in the Loop" description: "The Telegram Stars route for code sellers: a bot as the whole storefront, no bank or card processor anywhere in the loop, and automatic GitHub repo access delivery from a Cloudflare Worker." canonical: "https://edgekits.dev/en/blog/telegram-stars-github-repo-access/" published: "2026-09-05" tags: ["Telegram Stars", "Telegram", "GitHub", "Payments", "Cloudflare Workers", "RepoAccess"] --- Every payment rail in this series ends at a bank account. [Stripe wants one in 47 countries](/en/blog/sell-access-private-github-repo/); [Paddle wants a business it can verify](/en/blog/paddle-merchant-of-record-github-repo-access/). Telegram Stars want neither: the buyer pays inside the chat, the proceeds accumulate on your bot, and the exit is a wallet you control. No bank in the loop, start to finish. ## What Telegram Stars are for a code seller Stars are Telegram's in-app currency, and for digital goods they are not one option among several. Telegram's developer terms state that inside Telegram, [all sales of digital goods and services are carried out exclusively in Telegram Stars](https://core.telegram.org/bots/payments-stars) - a compliance requirement the App Store and Play Store impose on every in-app purchase. What most developers read as a restriction is, for a seller Stripe will not onboard, the whole point: the rail is mandatory, so it is also complete, first-party, and open to anyone with a Telegram account. The mechanics are simpler than any card rail. Your bot sends an invoice in the `XTR` currency, the buyer pays with Stars they topped up by card or through their app store, and the full invoiced amount lands on the bot - Telegram takes no commission on the sale itself. The Bot API covers the other direction too: `refundStarPayment` returns a buyer's Stars in one call. The exit is where Stars differ most from everything else in this series. Accumulated Stars convert to rewards at [an equivalent of 0.013 USD per Star](https://telegram.org/tos/bot-developers), become available up to 21 days after receipt, and are paid out through Fragment - Telegram's official partner platform - as Toncoin into a wallet you control. There is a second exit most write-ups miss: the same balance is worth 0.02 USD per Star as Telegram Ads credit, half again more than the cash rate if you were going to buy promotion anyway. > **TL;DR** > - Stars are the only compliant way to sell digital goods inside Telegram - the rail is mandatory, first-party, and open to any Telegram account > - The sale itself is commission-free: an `XTR` invoice for 5,000 Stars puts 5,000 Stars on your bot > - The exit is 0.013 USD per Star via Fragment into TON (up to 21 days after receipt), or 0.02 USD per Star as Telegram Ads credit > - No bank account, card processor, or country list appears at any step ## How selling for Stars differs from every card rail The first difference a card-rail seller notices is that there is no checkout page, because there is no web at all. The bot is the whole storefront: the product menu, the purchase dialog, the invoice and the payment all happen inside one chat, and the bot's profile - name, avatar, description - is your shop window. There is no provider dashboard behind it either; the bot is also where your sale alerts, stats and refunds live. The second difference removes an entire failure mode. On the web rails in this series, a buyer who mistypes their GitHub username finishes checkout anyway, and the worker catches the stranded payment with a claim-token fallback. A bot can talk back before money moves: it checks that the typed username names a real GitHub account before it ever sends the invoice, so a typo is refused in chat, nothing is charged, and the buyer simply types it again. The third difference is the refund model, and it changes who acts. Telegram sends no refund event, so nothing arrives for a webhook to react to - the refund is something you initiate through the bot, and that one tap is also the revoke: it returns the buyer's Stars and removes their GitHub access together. Chargebacks do not exist on this rail at all; a dispute is a buyer messaging your bot's support relay, not a bank reversing money behind your back. And the last difference is how you test. Stars have a test environment, but the practical pattern is two bots rather than two modes: a sandbox bot for proving changes and a production bot for buyers, each pointing at its own worker deployment with its own token and webhook secret. You test with a handful of real Stars and a real refund, and the refund returns them. ## The delivery half: the same Worker, a different front door Under the bot sits the same delivery engine as [every other rail in this series](/en/blog/lemon-squeezy-stripe-managed-payments-repo-access/): a single Cloudflare Worker that turns a verified payment into a GitHub team invite, and a verified refund into a revoke. The Telegram Stars adapter is part of [RepoAccess Pro](/en/tools/repoaccess/), and to the engine, Stars are just another provider speaking through the same normalized event interface: ``` pre_checkout_query -> final gate, answered before Telegram takes the Stars message.successful_payment -> grant (team invite to the verified username) refund, one admin tap -> refundStarPayment + revoke, together ``` Verification works differently here than on the card rails, and it is worth being precise about. There is no HMAC signature to compute: you set a `secret_token` when registering the webhook, Telegram echoes it back in the `X-Telegram-Bot-Api-Secret-Token` header on every update, and the worker compares it in constant time. Only Telegram ever saw that token, so a request carrying it is authentic - a simpler scheme than Paddle's or Stripe's, and one the adapter still refuses to shortcut. Idempotency carries over unchanged. Telegram retries webhook deliveries exactly like the card providers do, so every `successful_payment` carries its charge id into a deterministic workflow instance: the same payment can arrive five times and grant once. The charge id is also the correlation key the refund path hands to `refundStarPayment`, which is what lets one tap return the Stars and revoke the access as a single decision. ## An hour, a bot, and an agent that never sees your keys Setup follows the same pattern as the other rails: you do not assemble the pieces by hand, you run `/repoaccess-setup` in a coding agent and a wizard drives the whole route - BotFather, the GitHub org hardening, the worker deployment, the webhook registration with its secret token. The wizard treats every step as verified rather than trusted: it checks that each thing it asked for actually happened before moving on, and secrets go straight into their stores without ever passing through the agent's context. Roughly an hour end to end, and the model does not need to be expensive: the cheapest tier works - Haiku in Claude Code, or OpenCode's free default (for example, Big Pickle). The end state is the two-bot layout from earlier: a sandbox pair you prove changes on with a few real Stars and a real refund, and a production pair for buyers. ## What this costs, said plainly The sale itself costs nothing: an invoice for 1,000 Stars puts 1,000 Stars on your bot, with no percentage and no per-transaction fee. What a buyer paid for those Stars varies by where they topped up - buying by card is the base price, while app-store purchases cost more per Star because Apple and Google take their cut on the top-up, not on your sale. The real cost sits at the exit, so price in Stars with the exit in mind. Rewards convert at [0.013 USD per Star](https://telegram.org/tos/bot-developers), become available up to 21 days after receipt, and are paid through Fragment as Toncoin into your own wallet; Fragment currently requires at least 1,000 Stars per withdrawal. From there, turning TON into money on a card is a standard crypto exit - an exchange, a swap to a stablecoin, a P2P sale - and the whole chain from Stars to fiat typically loses another 3 to 5 percent to fees and spreads. A 1,000-Star product is 13 dollars at the reward rate and roughly 12.5 dollars once it reaches a card. There is one exit with no loss at all: the same balance is worth [0.02 USD per Star as Telegram Ads credit](https://telegram.org/tos/bot-developers). If you were going to promote your bot or channel anyway, spending Stars as ads is half again better than cashing them out - a detail that changes the math for anyone treating Telegram as their primary storefront. The delivery half stays in [Cloudflare's free tier](/en/blog/sell-access-private-github-repo/) exactly as on the other rails: the worker, the KV bookkeeping and the workflow runs all fit comfortably under free limits at indie sales volume. No bank account appears anywhere in this section, which is the entire argument of this article. ## The last rung of the ladder This series has been a ladder of decreasing requirements. Stripe asks for a bank account in one of 47 countries. Paddle asks for a business it can verify, and hands you a Merchant of Record in return. Telegram Stars ask for a Telegram account. That makes this rail the floor: whatever your jurisdiction, whatever your banking situation, this route exists. The storefront is a bot you own, the delivery runs on a Cloudflare account that costs nothing to hold, and the exit is a wallet only you control. The Telegram Stars adapter ships in [RepoAccess Pro](/en/tools/repoaccess/) - live-verified with real Stars and a real refund, deployed by your agent in about an hour. ## Frequently Asked Questions **Q: Can I sell digital goods in a Telegram bot without using Telegram Stars?** **A:** No. Telegram's developer terms state that all sales of digital goods and services inside Telegram are carried out exclusively in Telegram Stars - a compliance requirement the App Store and Play Store impose on in-app purchases. For physical goods other payment providers remain available, but code, content and subscriptions sold in a bot are Stars-only. --- **Q: How much is one Telegram Star worth to a seller?** **A:** Two numbers, depending on the exit. Withdrawn as rewards, each Star converts at an equivalent of 0.013 USD, paid through Fragment as Toncoin. Spent on promotion, each Star is worth 0.02 USD as Telegram Ads credit - half again more than the cash rate. What a buyer paid per Star is a third number entirely, since app-store top-ups cost more than card top-ups. --- **Q: How do I withdraw Telegram Stars to real money?** **A:** Stars become available up to 21 days after receipt and are withdrawn through Fragment, Telegram's official payout partner, as Toncoin into a TON wallet you control; Fragment currently requires at least 1,000 Stars per withdrawal. Turning that TON into money on a card is a standard crypto exit - an exchange, a swap to a stablecoin, a P2P sale - and the full chain typically loses 3 to 5 percent to fees and spreads. There is no direct Stars-to-fiat withdrawal. --- **Q: Do Telegram Stars payments have chargebacks?** **A:** No. There is no bank in the loop, so no bank can reverse a payment behind your back. Refunds are seller-initiated through the bot via refundStarPayment, and in RepoAccess that one action returns the buyer's Stars and revokes their GitHub access together. Disputes arrive as messages to your bot's support relay, not as debits. --- **Q: Does Telegram take a commission on Stars sales?** **A:** Not on the sale itself: an invoice for 1,000 Stars puts 1,000 Stars on your bot. The economics sit at the edges instead - app stores take their cut when buyers top up Stars, and the reward conversion rate of 0.013 USD per Star sets what a Star is worth on the way out. Price your product in Stars with the exit rate in mind. --- **Q: How does the worker verify that a webhook really came from Telegram?** **A:** Not with an HMAC. You set a secret_token when registering the webhook, and Telegram echoes it back in the X-Telegram-Bot-Api-Secret-Token header on every update. Only Telegram ever saw that token, so the worker authenticates updates by comparing the header in constant time - a simpler scheme than Stripe's or Paddle's signatures, held to the same discipline. --- **Q: Can a mistyped GitHub username strand a Stars payment?** **A:** No, and this rail is the only one in the series where the answer is a flat no. The bot validates that the typed username names a real GitHub account before it sends the invoice, so a typo is refused in chat and nothing is charged. Card rails validate after payment and recover through a claim link; the bot simply asks again before any Stars move. --- **Q: Do I need a bank account to sell GitHub repo access for Telegram Stars?** **A:** No. The full route is a Telegram account for the bot, a GitHub organization for the repos, a free Cloudflare account for the delivery worker, and a non-custodial TON wallet for withdrawals. No bank account, card processor or country list appears at any step - which is what makes this rail the floor of the series.