# Groups and access

# Groups and access

A group is authorized when it's on the bot's allowed list. Each feature decides for itself whether it checks that list.

## What "authorized" means

A message passes the authorization check when any of these is true:

#### Who's authorized

| Setting | Value |
| --- | --- |
| Owner or platform admin | In any chat. |
| DM-authorized username | In their own private chat with the bot. |
| Allowed group | Anyone in that group. |

There's no limit on how many groups you can allow.

## How a group gets authorized

#### /authorize

Sent by the owner or a platform admin, `/authorize` authorizes the chat. Sent by anyone else, it only adds the chat to the dashboard's Discovered Groups list, with no reply.

In a group the reply is `Authorized (<chat_id>).`, plus `To unlock image editing and full functionality, promote me to admin in this group.` when the bot isn't an admin yet. In a DM it replies `Authorized for edits.`

On failure: `Couldn't authorize this group — please try again.`

#### /getid

Anyone can send `/getid`. It replies with the chat's numeric id. When the owner or a platform admin sends it, the chat is authorized in the same step.

#### Groups

Only the owner or a platform admin can tap a row in `/menu` → Groups to authorize or remove that group. The picker is described in the previous chapter.

- [The Groups picker](/telegram-bot/introduction#the-groups-picker)

## How to remove an authorized group

*Two ways out*

| Path | Action |
| --- | --- |
| Groups | Tap a `✅` row to flip it to `❌` |
| The Groups tab | Trash icon on the group's card, then confirm |

There's no command for it. Removing a group stops image generation there.

## DM authorizations

A DM authorization gives one Telegram username the same access as an allowed group, but only in their own private chat with the bot. They can't authorize anything else.

#### DM-authorized usernames

| Setting | Value |
| --- | --- |
| Cap | 50 per bot |
| Configured from | The dashboard's Groups tab → `Authorize A DM`. No Telegram command creates one. |

Revoke from the same tab's trash icon. Access ends on their next message.

## The dashboard Groups tab

Owner only. `Discovered Groups` lists chats the bot has seen but you haven't authorized, shown in a modal. Select any number and tap `Authorize (n)`, or leave them unauthorized.

`Authorize A DM` pre-authorizes one username for DM generations. See DM authorizations below.

> **Note**
>
> Bots can't look up private invite links (`t.me/+…`, `/joinchat/…`). For a group you only have a private link to, send `/getid` inside the group and use the id. Same for the buy bot's own group list.

*Rows on the Groups tab*

| Row | What it is | Removable |
| --- | --- | --- |
| Allowed | A group you authorized | Yes |
| DM authorization | See DM authorizations above | Yes |

## Why groups need authorization

Each feature decides for itself whether it checks the allowed-groups list.

Where a check fails, the bot stays silent.

- [Who can start a raid](/raid-bot/raid-bot#who-can-start-a-raid)
- [MP3 downloader](/telegram-bot/tools-mp3-downloader)
- [The calls commands](/scanner/calls-commands)

## Buy bots are activated in groups separately

The buy bot posts to its own list of groups, separate from the allowed groups. Up to 10.

`/enablebuybot` in a group adds it to both lists.

> **Warning**
>
> Removing a group from the allowed list doesn't stop buys posting there. Remove buy bot targets from the buy bot's own Manage Groups (`/buybotgroups`, or the button on its settings card).

- [Buy bot setup](/buy-bot/buybot-setup)
- [Manage Groups — buy bot's picker](/buy-bot/buybot-commands#manage-groups)