QR Login in the Telegram API

What QR login is

Instead of typing a phone number and a code into a desktop or web app, the user scans a QR code on the screen with Telegram on a phone that is already logged in. If your app supports this, users never wait for a code. How it looks to users is in logging in to Telegram Desktop with a QR code.

The steps in your app (the side that logs in)

1. Call auth.exportLoginToken with your api_id and api_hash. If the app already has other accounts logged in, pass their IDs so they are excluded. The server returns a token and an expiry time.
2. Encode the token as base64url, build a tg://login?token=… address, and show it on screen as a QR code.
3. The token expires quickly. Before the expiry time in the reply, call exportLoginToken again and replace the QR code, for as long as the screen is open.
4. When the user scans and approves it on the phone, your app receives an updateLoginToken update. Call exportLoginToken once more.
5. If the answer is success (loginTokenSuccess), you are logged in. If it tells you to move to another data center (loginTokenMigrateTo), connect to that data center and finish with auth.importLoginToken; see data centers and _MIGRATE errors.

If the account has Two-Step Verification, SESSION_PASSWORD_NEEDED arrives at this point and you continue with the password check; see the user login flow.

The scanning side (the phone)

An official app that scans the code calls auth.acceptLoginToken with that token to approve the login. If your own app offers "approve a login on another device", this is the method you use. Before approving, always show the user which app is trying to log in, from which device and from where.

Where it usually gets stuck