Developer launches a paid AI bot in MAX and solves the negative-balance problem with balance holds

The code for a paid AI bot in a messenger is the easiest part of the job. That is the view of the creator of the "Ask AI" bot in MAX, where users can ask ChatGPT or Gemini a question and generate an image with Nano Banana. Payments can be made with a Russian bank card or through the Faster Payments System, SBP. The real complexity began with money, receipts, and laws—and anyone planning a paid bot should understand those issues.

Why MAX, and what to check before writing code

MAX comes preinstalled on smartphones sold in Russia, and it still has relatively few AI bots, so the niche is not as saturated as it is on Telegram. Since June 2026, the messenger has offered a partner platform for self-employed users: registration at business.max.ru, verification through Gosuslugi, up to two bots per person, and bot-card moderation taking up to 48 hours. Bots are available only to residents of the Russian Federation: self-employed individuals, individual entrepreneurs, and legal entities. This is worth checking before writing any code.

The Bot API has several quirks worth knowing in advance. There are no built-in payments comparable to Telegram Stars, so money is accepted through a link to an external payment provider. The API certificate is issued under the root certificate of Russia's Ministry of Digital Development and must be added to the server's trusted certificates.

The token is passed in the Authorization header without the Bearer prefix. The webhook works only over HTTPS on port 443 and must return a 200 response within 30 seconds, so the AI request is sent to a background queue. If the webhook returns errors for eight consecutive hours, MAX automatically unsubscribes the bot, meaning that without monitoring you can wake up to a dead bot.

Billing: reserves instead of hope

The main engineering challenge is avoiding a negative balance. Nobody knows how many tokens the model will generate in its response. A "check balance, send request, charge" flow fails immediately: a user has 100 credits and sends two expensive requests from a phone and a laptop; both pass the check, and the balance falls below zero. The bot owner covers the difference.

Each request therefore goes through four steps:

1. Upper-bound estimate. Input tokens are counted through the vendors' APIs—OpenAI has a token-counting endpoint, while Gemini provides countTokens—and output is capped with max_output_tokens. The model's reasoning tokens count toward the same limit. This produces an upper price bound that the user sees before submitting the request.
2. Hold. The amount is reserved in a single PostgreSQL transaction, with the balance condition included directly in the UPDATE. The database locks the wallet row, and the second request reevaluates the condition after accounting for the first hold. The idempotency key is the MAX update ID, so redelivery of the webhook does not create a second hold. The number of concurrent requests is limited to two.
3. Actual charge. After the response arrives, actual usage is read from usage. The smaller of the actual amount and the hold is charged, and the remainder is released.
4. Cleanup. If the process crashes, a background job releases the hold after its TTL expires. The vendor-request timeout must be shorter than the TTL; otherwise, the hold will be released while the model is still responding.

Every movement of money is recorded in an append-only ledger, allowing the balance to be reconstructed. The creator tested race conditions against a real PostgreSQL instance rather than mocks.

Models are handled separately: each family has three tiers because OpenAI's top model is 20 times more expensive than its entry-level model. If everyone gets the flagship model, a simple "translate this paragraph" request will cost as much as reviewing a contract.

Receipts and the law

Self-employed users face an unpleasant surprise: since December 29, 2025, YooKassa has stopped submitting their receipts to My Tax. Issuing them manually is not an option because, under the Professional Income Tax law, a receipt must be created at the time of payment. The creator chose Robokassa with its Robocheki SMZ service: receipts are submitted automatically and free of charge, payment links are supported, and ResultURL provides server-side notifications. Under the Starter plan, the fee is 3.9% for card payments and 2.7% for SBP. The ResultURL handler must be idempotent by invoice number; otherwise, a repeated notification will credit the same payment twice. Refunds of remaining funds are automated through the Robokassa API, with the receipt canceled accordingly.

The law does not explicitly prohibit this type of service, but it imposes many mandatory requirements. The creator notes that he is not a lawyer. One commonly missed requirement is notifying Roskomnadzor: since May 30, 2025, an individual can face a fine of 5,000–10,000 rubles. The public offer should prohibit users from uploading other people's photos without consent, because they will do so on the very first day.

What to do

If you are building a paid bot in MAX, begin with three things: make sure you are eligible to register on the platform, choose a payment provider that issues receipts automatically, and design the funds-reservation mechanism before the first model request—not after the first negative balance. Most of the work will go not into dialogue and generation, but into making sure money is accounted for fairly.