The short answer
- 1Log in at my.telegram.org with your number; the code arrives in the Telegram app, not by SMS.
- 2API development tools creates one api_id and api_hash per phone number.
- 3Treat the pair like a password, ship your own values, and never share the login code.
In this article
What api_id and api_hash are
To build an app that logs in as a person, with the Telegram API or TDLib, you need a pair of values: an api_id (a number) and an api_hash (a long string of letters and digits). They identify your app to Telegram's servers. If you are only building a bot, you do not need them; a bot runs on the single token @BotFather gives you. See choosing between the four APIs.
| Item | Detail |
|---|---|
| Where | my.telegram.org, under API development tools |
| You need | A Telegram account created in an official app, and that app signed in somewhere to receive the code |
| How many | The official guide says each phone number can currently have one api_id |
Getting the pair
- Open my.telegram.org in a browser on your computer and enter your phone number in international format, with the country code and without a leading zero.
- The same site manages apps and deletes accounts
- Your number in international format; the code arrives in the Telegram app
- Read the confirmation code in the Telegram app, not in your SMS. It arrives in the verified Telegram service chat. Enter it on the site and sign in. On a shared computer, leave Remember Me off.
- Open API development tools. The same page also offers Delete account, which is permanent; do not touch it.
- Fill in the form with an app title and a short name. Submitting it creates your api_id and api_hash. If you have created one before, the page shows that app's configuration instead.
Keeping the pair safe
An api_id and api_hash combined with your phone number login let a program act as your account. Treat them like a password.
- Keep them out of your code. Put them in environment variables or a config file, and keep that file out of your repository.
- Don't put your values into someone else's program. Handing over the pair together with a login code is the same as handing over the account.
- Ship your own values. Open-source examples include a sample api_id that is limited on Telegram's side; the official guide warns that releasing an app with it causes the API_ID_PUBLISHED_FLOOD error for your users.
Accounts on unofficial clients are watched
The official guide says all accounts that log in through unofficial API clients are automatically put under observation, and flooding or spamming leads to a permanent ban. If an account that did not break the rules is banned, the guide points to recover@telegram.org. What counts as abuse is in the API terms of service; the login flow itself is in the user login flow.
FAQ
Where do I get a Telegram api_id and api_hash?
Log in at my.telegram.org with your phone number, open API development tools and fill in the app form.
Do I need an api_id to build a Telegram bot?
No. Bots use the token from @BotFather. The api_id and api_hash are for apps that log in as a user.
What is API_ID_PUBLISHED_FLOOD?
An error users get when an app is released with the sample api_id from open-source examples. Use your own api_id before publishing.
Sources
At a glance
- 1Where
my.telegram.org, API development tools.
- 2Danger
The same login can delete your account.
- 3Safety
Keep values out of code; ship your own.
Updated
