How to create your own AI agent and connect it to Max: private access by authorization code
What will happen:
authorization code
What you need to know about bots in Max before you start
The main difference from Telegram is that an individual can't just open the constructor and create a bot in Max. Russian legal entities, sole proprietors and the self-employed have access. The profile must be confirmed by INN through Public Services or bank ID. Verification takes up to 48 hours.
There are also limits: sole proprietors and legal entities can create up to 5 bots, self—employed - up to 2. One bot is linked to only one integration, so it is better to create different bots for different scenarios, rather than mixing everything into one.
@MasterBot no longer issues tokensplatform-api2.max.ruplatform-api.max.ru
Step 1. Create a bot in Max and get a token
business.max.ru
- ""Chatbots" → "Create"
- Fill in the bot's card. The nickname is generated automatically according to a template with the INN and the organization's identifier.
- Wait for moderation. The documentation specifies a time limit of up to 48 business hours, but in practice it sometimes turns out faster.
- ""Chat"" → "Go to" → "Advanced Settings" → "Set Up"
AAH...
max.ru/business_bot
Step 2. Create an AI agent in Softrestchat
Softrestchat"Agents" → "Create Agent"RAGknowledge base search
according to internal regulations
Before connecting the channel, check your credit balance and ask some security questions in the test chat. If the agent gets confused in his office, he will not become more accurate in the messenger.
Step 3. Connect the Max channel
"Channels" → "Max""Bot Token""Generate"The "Secret key"
The secret key is not a password for users.
The restriction of people's access is enabled separately through the agent's private mode. It is he who solves the problem of "the bot responds only to its own".
Step 4. Close access with a password: private mode
"Privacy""Private mode"
The mode is enabled on the agent as a whole, and not on a separate channel.On the "Website" channelbot_started/start
How it works
Until the code is entered, the model does not respond, the greeting does not go away, the user's messages do not get into the dialog history and are not transmitted to the model. Prior to authorization, the correspondence does not actually exist.
- The user opens the bot.
- The system creates a waiting session and an 8-character code: Latin letters and uppercase numbers.
- The bot asks for a code, but the code itself is not sent to the chat. The owner copies it from the cabinet and passes it to the person separately.
- The user sends the code to the same chat.
- "Authorization is successful. You can start a dialogue."
- Access is linked to the user's ID in the messenger and to the agent, not to a specific chat.
The key idea is simple: the secret is not the link to the bot, but the code from the cabinet. The code is not published anywhere, does not come to the chat automatically and is transmitted via the channel that the owner chooses.
What an unauthorized user sees
"Authorization is required to access the assistant.""Enter the authorization code that you received in your personal account.""Access is limited. Please log in to continue.""Invalid authorization code. Try again."
How to grant and revoke access
"Authorized sessions"
- Codes are not created in advance: a person must first contact the bot.
- The code comparison is case-sensitive. Uppercase letters cannot be rewritten with lowercase letters.
- The code and the session do not have a lifetime: access is valid until the session is deleted.
- Restarting does not release a new code, an already issued one is used.
- After deleting the session, the next session will create a new wait and a new code.
bot_startedin the Telegram/start
An honest caveat: the authorization code is access control, not encryption or separation of rights. All authorized users see the capabilities of the same agent. If the sales department cannot see the accounting documents, different agents with different knowledge bases are needed, not one common code.
Step 5. Teach the agent to call a person and collect applications
Another scenario works better for an internal assistant: "create a task for the responsible person", when an employee asks for something that is not in the knowledge base. Then the gap in the regulations is not lost in the correspondence, but turns into a specific task for the owner of the process. The "Call the Operator" post-script is needed where AI is not supposed to portray omniscience.
Command /new: start a conversation from scratch
/new/new
"A new dialogue has been created. You can start chatting."
New topic — new dialogue
That a bot in Max can't — and it's not treated by setting up
The first limitation is that the bot cannot write first to someone who has not started the dialogue himself. There is no way to get around this through the API, mailing lists are impossible in principle. For a corporate scenario, this means that each employee must open a bot and log in.
Secondly, some iPhone users may not have push notifications working. After removing Max from the App Store and Google Play, those who installed the app on iOS earlier had problems with notifications and updates. A practical conclusion without estimates: a significant proportion of people on the iPhone may not see the answer right away. On Android, installation is available through RuStore, AppGallery, Galaxy Store, GetApps and the official website.
Third, there is no native payment in the bot. Payments will have to be made through external providers or SBPs. There are also technical ceilings: 30 requests per second, up to 4,000 characters per message, up to 12 attachments, an image up to 50 MB, a video up to 250 MB, a file up to 4 GB, and deleting a message is only possible if it is less than 24 hours old.
Max is changing rapidly: on May 25, 2026, support for HTTP webhooks and self-signed certificates was discontinued, and in June 2026, the chat list method was decommissioned. Therefore, it is better to double-check the instructions from a year ago in this topic from scratch.
How to check before launching
Do not test from the account under which you created the bot, but from a regular personal account. Before entering the code, the agent should not greet and respond to the point. Enter the wrong code, then the correct code in lowercase letters — it should not pass, because the case is taken into account.
After authorization, ask 20-30 real questions: about regulations, prices, procedures, and disputes. Make sure that the agent refuses to respond to what he shouldn't, doesn't retell the documents in their entirety, and correctly calls the person if there is no response.
/new
What to do next
The optimal launch procedure is as follows: first submit the organization for verification in Max, then assemble the agent in Softrestchat, download the knowledge base, set up the Max channel and enable private mode. Verification will still take up to two days, so it should not be left for the final.
Автор
Антон Амосов
