Introduction

If by "authorization with Telegram" you mean letting users sign in to your website or app with their Telegram identity, the right tool is not a generic Bot API token exchange. The current Telegram-supported approach is Telegram login, where Telegram sends signed user data and your server verifies that signature with the bot token.

Authentication Versus Authorization

Telegram mainly helps with authentication here: proving who the user is. Your application still decides authorization: what that user is allowed to do after sign-in.

So the usual design is:

1. Telegram identifies the user
2. your backend verifies the Telegram payload
3. your app creates or looks up a local user record
4. your app applies its own roles and permissions

That separation is important because Telegram does not know your application's permission model.

Telegram Login Flow

Telegram provides a login widget and related login flow. After successful login, your site receives fields such as:

• 'id'
• 'first_name'
• 'username'
• 'photo_url'
• 'auth_date'
• 'hash'

The hash is the critical security field. Telegram documentation says you should recompute an HMAC-SHA-256 signature over the received data using the SHA-256 hash of your bot token as the secret key, then compare it to the received hash.

Server-Side Verification Example

Here is a compact Python example:

1import hashlib
2import hmac
3
4
5def verify_telegram_auth(data, bot_token):
6    received_hash = data.pop("hash")
7
8    check_string = "\n".join(
9        f"{key}={value}"
10        for key, value in sorted(data.items())
11        if value is not None
12    )
13
14    secret_key = hashlib.sha256(bot_token.encode()).digest()
15    computed_hash = hmac.new(
16        secret_key,
17        check_string.encode(),
18        hashlib.sha256,
19    ).hexdigest()
20
21    return hmac.compare_digest(computed_hash, received_hash)

If verification succeeds, you can trust that the payload came from Telegram and was not modified in transit.

Turn Telegram Identity Into App Authorization

Once the identity is verified, store the Telegram user ID in your own user table:

1def authorize_telegram_user(data):
2    telegram_id = str(data["id"])
3
4    allowed_admins = {"123456789", "987654321"}
5    if telegram_id in allowed_admins:
6        return "admin"
7    return "user"

This is the real authorization step. Telegram proves identity; your app decides role membership.

Bot Authorization Is a Different Problem

If your use case is not website login but "allow only some Telegram users to use a bot command," the pattern is simpler:

• receive a bot update
• inspect message.from.id
• compare it against your own allowlist or role table

That is still authorization, but it is authorization inside your application logic, not OAuth-style delegated access.

Security Requirements

A solid implementation should also:

• verify the hash
• check auth_date so stale payloads are rejected
• keep the bot token secret
• use HTTPS on the callback or redirect endpoint
• create your own application session after verification

Never trust Telegram-provided fields blindly without server-side verification.

Common Pitfalls

The biggest mistake is treating the Bot API token as if it were an access token you hand to clients. It is a server secret.

Another mistake is using Telegram data as authorization by itself. A valid Telegram login does not automatically mean the user is allowed to do everything in your app.

A third issue is skipping the hash verification step and trusting the callback payload directly.

Summary

• Telegram login is mainly an authentication mechanism, not your full authorization system.
• Verify the signed payload server-side using the bot token-derived secret.
• After verification, map the Telegram user ID to your own local roles and permissions.
• For bot command access control, check Telegram user IDs inside your own app logic.
• Keep the bot token secret and reject unverified or stale login payloads.