AT.dz Auto Rechargement Secours Bot

Made by Marouane

A small PHP toolkit that automates logging into a client.at.dz (Algérie Télécom) account, checking subscription info, and triggering the "Rechargement de secours" (36h/96h emergency top-up), exposed both as a JSON API and as a Facebook Messenger bot.

What's in this repo

File	Purpose
fetch.php	Not included in this repo (proprietary/private — see note below). Logs into client.at.dz with a given nd (fax number/login) + password, optionally triggers the emergency rechargement, and returns account info as JSON.
webhook.php	Facebook Messenger webhook that walks a user through providing their credentials and calls fetch.php on their behalf.

Note: fetch.php is kept private and is not published in this repository. The documentation below describes its API contract (endpoints, parameters, response format) so you can understand how webhook.php integrates with it, or implement your own equivalent. All rights to the original fetch.php implementation are reserved.

Requirements

• PHP 7.4+ with the curl, dom, and session extensions enabled
• A web server (Apache/Nginx) or PHP built-in server
• HTTPS on the domain hosting these scripts (Facebook requires HTTPS for webhooks, and you're transmitting credentials — don't run this on plain HTTP)
• A Facebook Page + Meta App with Messenger enabled (only needed for webhook.php)

1. fetch.php — the API

Setup

This file is not distributed with the repo. If you have your own copy, just upload it to your server — no configuration needed inside the file itself, it takes everything via query parameters. Otherwise, use the API contract below to build your own compatible implementation.

Usage

Check account info / log in:

GET https://yourdomain.com/fetch.php?nd=YOUR_ND&password=YOUR_PASSWORD

Log in AND trigger the 36h/96h emergency rechargement:

GET https://yourdomain.com/fetch.php?nd=YOUR_ND&password=YOUR_PASSWORD&36h=true

Response format

Success:

{
    "success": true,
    "message": null,
    "secours_36h": "success",
    "expiration": {
        "label": "Votre abonnement internet expire le",
        "value": "12/09/2026"
    },
    "account_info": [
        { "label": "Nom", "value": "..." },
        { "label": "Numéro", "value": "..." }
    ]
}

secours_36h will be one of:

• null — you didn't request it (no 36h=true param)
• "success" — rechargement was applied
• "already_done" — you already used your rechargement for this period

Failure (wrong credentials, unreachable site, etc.):

{
    "success": false,
    "message": "Incorrect username or password."
}

HTTP status codes: 400 missing params, 401 bad credentials, 502 upstream/site error.

⚠️ Security note

Credentials are passed as GET query parameters. This means they can end up in:

• Your server's access logs
• Browser history (if called directly from a browser)
• Referrer headers of any page that links to a URL like this

If this API is reachable from anywhere other than your own trusted server-to-server calls, switch nd/password to POST body parameters instead.

2. webhook.php — the Messenger bot

This wraps fetch.php in a conversational flow so users can check their account and request the rechargement directly from Facebook Messenger.

Setup

1. Edit the constants at the top of webhook.php:

   define('PAGE_ACCESS_TOKEN', 'YOUR_PAGE_ACCESS_TOKEN');
   define('VERIFY_TOKEN', 'YOUR_OWN_RANDOM_VERIFY_TOKEN');
   define('FETCH_API_URL', 'https://yourdomain.com/fetch.php');

   • PAGE_ACCESS_TOKEN comes from your Meta App's Messenger settings (Page-specific token).
   • VERIFY_TOKEN is any random string you choose — you'll enter the same value in the Meta dashboard.
   • FETCH_API_URL must point to wherever you deployed fetch.php.

2. Upload webhook.php to a public HTTPS URL, e.g. https://yourdomain.com/webhook.php.

3. Configure the webhook in Meta App Dashboard:

   • Go to your App → Messenger → Settings → Webhooks
   • Callback URL: https://yourdomain.com/webhook.php
   • Verify Token: the same string you put in VERIFY_TOKEN
   • Subscribe to the messages field
   • Click Verify and Save

4. Subscribe your Page to the app so it starts receiving message events.

Conversation flow

1. User sends start → bot asks for their nd (fax/login number)
2. User sends their nd → bot asks for their password
3. User sends their password → bot calls fetch.php, shows account info + expiration date, and asks if they want the 96h extension
4. User replies نعم / yes or لا / no → bot triggers the rechargement (if yes) and shows the result, then ends the session

Session state is tracked per-user via PHP sessions keyed on the Messenger sender ID.

⚠️ Security notes

• Passwords are stored in the PHP session in plaintext for the duration of the conversation (needed to call fetch.php again for the extension step). Sessions are destroyed at the end of the flow, but consider lowering session.gc_maxlifetime on your server so abandoned sessions don't linger with credentials in them.
• There is currently no verification of Facebook's X-Hub-Signature-256 header on incoming webhook calls, meaning anyone who discovers your webhook URL could send it fake message events. If this bot is public-facing, add signature verification using your App Secret before going to production.
• Treat PAGE_ACCESS_TOKEN and VERIFY_TOKEN as secrets — don't commit real values to a public repo. Use environment variables or a gitignored config file instead of hardcoding them if you publish this.

License

© Marouane. All rights reserved. The fetch.php implementation is proprietary and not licensed for reuse, redistribution, or reverse engineering. webhook.php and this documentation are shared for reference; contact the author before reusing them in another project.

Disclaimer

This project interacts with a third-party site (client.at.dz) that is not affiliated with this repository. Automating login and account actions may violate that site's terms of service — use at your own risk and only with accounts you own or have explicit permission to manage.