Anyone who is a superadmin on a Viber channel can post on a Viber channel as any of the other superadmins. And you can add any random viber user as a superadmin and they do not have to accept an invite as they were invited as superadmins.
All superadmins can see the channels’ authentication key which can be used with the Channels Post API.
Each member in the channel has a userid associated, which the API endpoint gives you whenever you make a request with the API key. The API endpoint cannot differentiate between the different superadmins, (as the same authentication key is shared with every superadmin) so they give the user_id of every single superadmin for each request.
Viber in their docs claim that the channel’s name can be seen as the sender rather than the superadmins, however this is not true or not working as of now. The sender ids shown are the users profile rather than the channel name.
However, from my tests I see that the random person I add to the channel does not carry the channels alias.
How it should be . .
I think the problem starts from every single member having access to a singular API key and viber letting people see the user_id of all superadmins. Instead if every superadmin were to have a different API key or even better if the viber interface were to show the user_id within the developer tools menu, this whole problem goes away.
This way, channel API is essentially giving all superadmins the power to make all other superadmins say things from their profile. And if you click on the user’s profile and click message, Viber shows you the number of the users. This can be prevented by not letting subscribers contact you in the channel settings, But then again, this control is also with the rest of the superadmins so if this is a real impersonation case where someone is adding specific people as superadmins and making them say things, this person has the control for that button same as others.
Perhaps the name of this channel is a Political Party or an NGO or a Company’s Internal Group. And making people say these things could be a big issue.
To experiment with this by just using Cloudflare workers and an API client, see: https://github.com/fauzaanu/viberchannelposter
Telegrams implementation of channels does not allow users to see who they are. But in Viber, the behavior is by default to show the users behind the message. Telegram uses signatures rather than show the names, and it is off by default. Even between the channel admins in a telegram channel, it’s impossible to tell who sends a message unless signature is on.
Viber’s channels are just bad. Switch to Telegram.