WP Manifestindependent plugin directory
manifest / integrations / telegram-crm-wp-inbox

Telegram CRM Inbox

WordPress admin plugin: Telegram CRM inbox via REST proxy with encrypted server-side tokens

by Telegram CRM · github.com/saeednabat/telegram-crm-wp-inbox · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/saeednabat/telegram-crm-wp-inbox/archive/refs/heads/main.zip
Readme github.com/saeednabat/telegram-crm-wp-inbox ↗

Telegram CRM Inbox (WordPress plugin)

Independent WordPress admin plugin (sibling of telegram-service) that lists Telegram CRM conversations and sends text replies. The browser talks only to this site’s wp-json routes; PHP proxies to the SaaS API with JWT tokens stored server-side (AES-encrypted with AUTH_KEY / AUTH_SALT when OpenSSL is available). Tokens are never exposed to JavaScript.

Requirements

  • WordPress 6.0+
  • PHP 7.4+ (openssl recommended)
  • No Composer dependencies (wp_remote_* only)
  • A Telegram CRM SaaS user (email/password → JWT)

Paths

Item Path
Project root /home/saeed/projects/telegram-crm-wp-inbox
Main plugin file /home/saeed/projects/telegram-crm-wp-inbox/telegram-crm-inbox.php
Zip output (example) /home/saeed/projects/telegram-crm-wp-inbox.zip

Install

Zip and upload

cd /home/saeed/projects
zip -r telegram-crm-wp-inbox.zip telegram-crm-wp-inbox \
  -x 'telegram-crm-wp-inbox/.git/*' \
  -x 'telegram-crm-wp-inbox/.gitignore'

In WordPress: Plugins → Add New → Upload Plugin → choose telegram-crm-wp-inbox.zip → Activate.

Symlink / copy (dev)

ln -s /home/saeed/projects/telegram-crm-wp-inbox \
  /path/to/wp-content/plugins/telegram-crm-inbox

Or copy the folder into wp-content/plugins/ and activate Telegram CRM Inbox.

On activation, administrators receive the telegram_crm_inbox capability (manage_options is also accepted).

Configure

  1. Open Telegram CRM Inbox → Settings
  2. Set SaaS API base URL, e.g. https://your-api.example.com
    • If the path does not already end with /api/v1, the plugin appends it
  3. Enter CRM user email and password, then Connect
  4. Password is used once for POST /api/v1/auth/login and is not stored
  5. Access + refresh tokens are stored encrypted in a WordPress option

REST routes (this WordPress site)

Method Route Proxies to SaaS
GET /wp-json/telegram-crm/v1/status (local status only)
GET /wp-json/telegram-crm/v1/inbox GET /api/v1/contacts?hasMessages=true
GET /wp-json/telegram-crm/v1/messages/{contactId} GET /api/v1/contacts/{id}/messages
POST /wp-json/telegram-crm/v1/messages/{contactId} POST /api/v1/contacts/{id}/messages { "text": "..." }

All require a logged-in user with telegram_crm_inbox or manage_options, plus a valid X-WP-Nonce (wp_rest).

Security (MVP)

  • Tokens never appear in localized script data or REST responses
  • Connect/disconnect forms use admin nonces
  • REST permission callback checks capability + wp_rest nonce
  • Prefer HTTPS for WordPress and the SaaS API

Limitations (MVP)

  • Text replies only (no media, templates, keyboards, edit/delete)
  • No realtime / SSE (use Refresh)
  • No assignment, tags, snooze, or multi-org UI
  • Single connected CRM account per WordPress site
  • Basic HTML/CSS admin UI
  • Access-token TTL is estimated; refresh runs on expiry and on HTTP 401

Layout

telegram-crm-wp-inbox/
├── telegram-crm-inbox.php
├── includes/
│   ├── class-settings.php
│   ├── class-api-client.php
│   ├── class-rest.php
│   └── class-admin-inbox.php
├── assets/
│   ├── admin.css
│   └── admin.js
└── README.md

License

GPL-2.0-or-later (WordPress plugin convention).