Choosing a messaging API for your AI agent: Telegram, WhatsApp and iMessage

​

TL;DR: pick by need

​

Side by side

​

When Flow is not the right choice

• You need WhatsApp in production now. Flow’s WhatsApp is waiting for Meta’s approval.
• You need SMS, RCS, voice, email, Slack, Discord or any channel beyond Telegram and iMessage. None of these is available on Flow yet. Twilio and the other CPaaS providers cover SMS, RCS and voice, the iMessage APIs below fall back to SMS, and Photon lists more channels than Flow, with RCS and SMS fallback on its plans.
• Your agent must start iMessage conversations, or use groups or FaceTime calls. Flow’s iMessage line answers people who wrote first, one-to-one, and lines are arranged with the Flow team rather than self-serve.
• You must self-host, or keep message data on your own infrastructure. Flow is a hosted service only; its spec and SDKs are open source, the service is not.
• You need published prices, a contractual SLA or a compliance certification today. Flow is in beta and publishes none of these yet.
• You run one simple Telegram bot. The Bot API is free, and a few dozen lines of code may be all you need (see below).
• You want a Python or Go SDK today. Flow’s TypeScript SDK is on npm (@flow-engineer/messaging); the Python and Go SDKs are coming, so until then other languages call the HTTP API.

​

The Telegram Bot API directly

• Downtime. Telegram retries a failed webhook and gives up “after a reasonable amount of attempts” (Telegram, Oct 2026), and keeps undelivered updates for at most 24 hours (Telegram, Oct 2026).
• Order and duplicates. update_id increases sequentially so that you can drop repeats and restore the order yourself when updates arrive out of order (Telegram, Oct 2026).
• Rate limits. About one message per second per chat, 20 per minute in a group and about 30 per second in bulk unless paid broadcasts are enabled, with 429 errors beyond that (Telegram, Oct 2026); the error’s retry_after gives the seconds to wait (Telegram, Oct 2026).
• Sending twice. If a send times out, you cannot tell whether it went out, so you need your own guard against repeating it.
• Who can be messaged. Bots cannot start conversations; the person messages the bot first (Telegram, Oct 2026). This rule applies through Flow too.

• Ordering: events reach you in order per conversation, one at a time.
• Retries without duplicates: webhooks are retried for 3 days and every event stays in a log you can replay; every send takes an Idempotency-Key, so a retry never sends twice.
• The send gate: pacing per sender, refusals with typed errors (type, hint, doc_url) instead of raw channel errors.
• Signed webhooks: an HMAC-SHA256 Flow-Signature on every delivery, and the option to reply in the webhook answer.
• The sandbox: a shared test bot and a test key with no account, so you can try it before you make a bot.
• One API across channels: the same code answers on iMessage, and on WhatsApp when it opens.

// app/api/telegram/route.ts. Register it once:
// curl "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/setWebhook" \
//   -d url=https://example.com/api/telegram -d secret_token=$TELEGRAM_WEBHOOK_SECRET
export async function POST(req: Request) {
  if (req.headers.get("X-Telegram-Bot-Api-Secret-Token") !== process.env.TELEGRAM_WEBHOOK_SECRET) {
    return new Response(null, { status: 401 });
  }
  const update = await req.json();
  const msg = update.message;
  if (msg?.text) {
    await fetch(`https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/sendMessage`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ chat_id: msg.chat.id, text: `Echo: ${msg.text}` }),
    });
  }
  return new Response("ok");
}

// app/api/flow/route.ts
import { createHmac, timingSafeEqual } from "node:crypto";

// Flow-Signature: t=<unix>,v1=<hex HMAC-SHA256 of "t.<t>.<raw body>">
function verify(body: string, header: string, secret: string): boolean {
  const parts = header.split(",").map((p) => p.trim().split("="));
  const t = parts.find(([k]) => k === "t")?.[1];
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const want = createHmac("sha256", secret).update(`t.${t}.${body}`).digest();
  return parts.some(([k, v = ""]) => k === "v1" && /^[0-9a-f]{64}$/.test(v) && timingSafeEqual(want, Buffer.from(v, "hex")));
}

export async function POST(req: Request) {
  const body = await req.text(); // the raw body: a re-serialized one will not verify
  if (!verify(body, req.headers.get("Flow-Signature") ?? "", process.env.FLOW_MESSAGING_WEBHOOK_SECRET!)) {
    return new Response(null, { status: 400 });
  }
  const event = JSON.parse(body);
  if (event.type !== "message.received") return Response.json({});
  // The reply goes through the send gate into the same conversation, keyed by the event's ID.
  return Response.json({ reply: `Echo: ${event.data.message.content.text ?? ""}` });
}

​

Twilio and other CPaaS providers

• Telegram is not among the channels on Twilio’s Messaging docs, and Apple Messages for Business is a private beta (sources in the table above).
• Webhooks are signed with HMAC-SHA1 in X-Twilio-Signature (Twilio, Oct 2026). Retries are set per webhook URL with connection overrides, a fragment on the URL such as #rc=3&rp=5xx,ct: by default a webhook is retried once, on connection failures only, within 15 seconds in total, and you can set up to 5 retries and which failures count (Twilio, Oct 2026). Status callbacks are not guaranteed to arrive in order (Twilio, Oct 2026).
• WhatsApp’s 24-hour window is yours to handle: outside it only approved templates go, and other sends fail with error 63016 (Twilio, Oct 2026).
• US SMS from a 10DLC number needs A2P 10DLC registration, hobbyists included (Twilio, Oct 2026).

​

iMessage APIs for agents

​

About Flow, today

• Live: Telegram (sandbox bot, or your own bot once you sign in with GitHub); the TypeScript SDK on npm (@flow-engineer/messaging); iMessage replies on lines arranged with the Flow team; signed, ordered webhooks and a WebSocket stream; the send gate; typed errors with hints; a hosted MCP server, which the project owner can choose to add to their coding tools; test keys with no account (POST /v1/sandbox/keys); GitHub sign-in and a dashboard.
• Not available yet: SMS and voice.
• Coming: WhatsApp (pending Meta’s approval); Python and Go SDKs; docs.flow.engineer (not deployed yet; meanwhile see llms.txt and the OpenAPI spec).

​

Related

• Flow vs Photon (spectrum-ts)
• Quickstart, Keys and sign-in, The send gate, Events and webhooks