A Funnel Bot That Lets People Into a Private Channel

Application → site signup → check → private channel: the bot walks the whole path itself. The landing shows both sides at once — the client chat and the manager phone, live. Signups arrive as HMAC-SHA256-signed webhooks; a wrong Telegram or a reused link is rejected with the reason printed. Invite links are one-time with a 30-minute TTL, joins are fixed by chat_member updates, and duplicates are impossible by status design. A manager can just forward a DM — the bot parses name and phone itself, no userbot on a personal account. You can check it: https://leadgate.devs-code.site

• Two live fronts, one core: a real Telegram bot and its web twin on the landing
• Manager view with working buttons: approve, decline, resend the link
• Signup webhook signed with HMAC-SHA256 — a forged call lands in the public log
• One-time invites, 30-minute TTL; joins recorded from chat_member, not on trust
• Red path built in: press “submit with a wrong Telegram” and watch it get rejected
• One process on SQLite + aiogram 3 + FastAPI; the stand resets itself every 6 hours