Telegram Login — Authentication & Developer Platform

Telegram Login lets website and application users sign in with their Telegram accounts. It supports OpenID Connect (OIDC), Authorization Code Flow with PKCE, signed identity tokens, and optional user-approved access to profile, phone number, and bot messaging permissions.

Overview

Telegram offers developers a login library for websites, native SDKs for iOS and Android, and OIDC integration for compatible authentication systems. Telegram Login is useful for software-as-a-service platforms, communities, developer services, and applications whose audiences already use Telegram.

Key Features

• Telegram account login on websites and applications.
• OpenID Connect (OIDC) with authorization code flow and PKCE (S256).
• Signed ID tokens with server-side verification using public keys.
• Profile details when the profile scope is authorized.
• Optional verified phone number with consent through the phone scope.
• Optional bot messaging permission via telegram:bot_access.
• Browser library and native iOS and Android SDKs.
• Approved website origins and redirect URLs registered through BotFather.

How Telegram Login Works

1. Set up the bot. Create or select an application bot in Telegram BotFather and open its Login Widget settings.
2. Register URLs. Add permitted website origins and exact redirect URIs. Obtain the Client ID and Client Secret.
3. Select integration. Use the Telegram Login JavaScript library, a native SDK, or an OIDC-compatible client.
4. Request authorization. Use the mandatory openid scope and request only additional data you need. For the code flow, generate a random state and a PKCE challenge.
5. Exchange the code. Complete the token request securely on the server using the client credentials and PKCE verifier.
6. Verify and sign in. Validate the ID token signature, issuer, audience and expiry before creating an authenticated application session.

Developer Security Checklist

• Use HTTPS and register exact callback URLs.
• Keep the Client Secret on the server, never in browser code.
• Use a random state to protect the authorization response against cross-site request forgery.
• Use PKCE with S256 and verify the token on the backend.
• Verify JWT signatures against Telegram’s JWKS and check issuer https://oauth.telegram.org, expected audience and expiry.
• Request phone and messaging permissions only when needed and with appropriate consent.

Integration note: Telegram does not currently provide a separate OIDC UserInfo endpoint, so third-party identity libraries expecting one may need that request disabled. Telegram’s popup login library can also conflict with a strict Cross-Origin-Opener-Policy: same-origin header; check its documented popup policy guidance.

Telegram Login Compared With Email Authentication

Area	Telegram Login	Traditional Email Login
Account	Existing Telegram account	Typically separate email-based account
Integration	Telegram bot, OIDC or SDK	Email provider and application identity stack
Verification	Signed OIDC identity token	Implementation-dependent
Communication	Optional authorized Telegram bot access	Email messaging

Frequently Asked Questions

Does Telegram Login support OIDC?

Yes. Telegram publishes discovery configuration and supports the authorization code flow with PKCE.

Do I need a Telegram bot?

Yes. The bot represents the application and is configured through BotFather.

Can I request a user’s phone number?

Yes, with the phone scope and the user’s consent.

Can it be used on mobile?

Yes. Telegram offers dedicated iOS and Android SDKs.

Can the bot automatically message everyone who signs in?

No. Appropriate messaging access must be requested and authorized.

Is decoding a JWT sufficient to identify the user?

No. Always verify the signature and security claims before trusting an identity token.

Official Developer Resources

Category: Developer Tools / Authentication / API Integration
Best for: Web developers, SaaS businesses, mobile app developers and Telegram-connected digital services

Official Telegram Login documentation

This independent BESTE listing is informational and is not operated or endorsed by Telegram.