How to Use Log In with Telegram
Implement passwordless one-tap WebAuth sign-in, eliminate SMS intercept vulnerabilities, and authorize third-party web services with cryptographically verified HMAC signatures.
Traditional web authentication reliant on passwords and SMS one-time passcodes (OTPs) is notoriously vulnerable to data breaches, phishing kits, and SIM-swapping attacks. Log In with Telegram provides web developers and end users with a frictionless, high-security OAuth2 alternative. By linking a Telegram bot to your web application, users can authenticate in a single tap without revealing their phone number, while web backends verify authenticity using cryptographic SHA-256 HMAC tokens generated directly by Telegram's core infrastructure.
Passwordless 1-Tap Login
Users click a single button to sign in. No passwords to remember, no CAPTCHAs to solve, and zero friction across desktop and mobile browsers.
Zero SMS Cost & Anti-SIM Swap
Verification requests arrive instantly inside Telegram via the official Service Notifications channel, completely bypassing telecom SMS intercept risks.
Centralized Session Control
Users retain complete sovereign control over authorizations, viewing all connected third-party websites in Telegram Settings and revoking access instantly.
OAuth2 WebAuth & HMAC Token Simulator
Simulate the client authorization sequence and inspect the cryptographic payload passed to web servers.
Sign in to Cloud Dashboard
Authorize with your Telegram identity to continue.
Cryptographic Architecture: How Telegram HMAC Verification Operates
When a user authorizes access via the Telegram Login Widget, the web client receives a JSON payload containing the user's public profile fields (id, first_name, username, auth_date, and photo_url) alongside an HMAC-SHA256 signature hash. To guarantee that malicious actors have not forged the user identity, the developer's server verifies the hash using a secret key derived from their Telegram Bot Token.
| Step / Component | Implementation Detail | Security Mechanism |
|---|---|---|
| 1. Key Derivation | secret_key = SHA256(bot_token) |
Prevents raw bot token exposure in transit |
| 2. Data String Assembly | Alphabetically sorted key-value pairs joined with newline (LF) delimiter |
Canonical representation prevents parameter tampering |
| 3. HMAC Validation | HMAC_SHA256(data_check_string, secret_key) == hash |
Cryptographic proof of Telegram origin |
| 4. Anti-Replay Check | abs(time() - auth_date) < 86400 |
Stops replay attacks using stale tokens older than 24h |
| 5. Direct Notifications | User receives Telegram security message: "You logged in to..." | Immediate detection if user account is compromised |
How to Set Up & Use Log In with Telegram
Creating the Auth Bot via @BotFather
Open Telegram and message @BotFather. Send /newbot to configure a dedicated authentication bot (e.g. @MyServiceAuthBot). Next, send /setdomain, choose your bot, and enter your website's exact production domain (e.g., app.example.com). Telegram will reject authentication attempts coming from unverified domains.
Embedding the Web Widget Script
Add the official script to your login page: <script async src="https://telegram.org/js/telegram-widget.js?22" data-telegram-login="MyServiceAuthBot" data-size="large" data-auth-url="https://app.example.com/api/auth/callback" data-request-access="write"></script>. Setting data-request-access="write" allows your bot to dispatch notifications directly to the user.
Reviewing & Revoking Authorized Sessions
As a user, you can view every website you have ever logged into with Telegram. Navigate to Settings > Privacy & Security > Active Sessions > Logged in with Telegram. Tap any connected service and select Disconnect to instantly revoke the website's access privileges.
Frequently Asked Questions
