skills.rest
korjavin
korjavinCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

telegram-web-login

Integrate Telegram Login Widget authentication with signature validation for web apps.

Updated Dec 24, 2025
Search Tags:#security#authentication#telegram#cookie-auth#web-app#web-login
One-click install
npx skills add https://github.com/korjavin/claude-common-skills --skill telegram-web-login
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: telegram-web-login
Source: https://github.com/korjavin/claude-common-skills/tree/main/skills/telegram-web-login
Command: npx skills add https://github.com/korjavin/claude-common-skills --skill telegram-web-login

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables secure Telegram-based user authentication for web applications by integrating the Telegram Login Widget and validating signatures to verify user identity.

Core Features & Use Cases

  • Telegram Login Widget integration for browser-based authentication
  • HMAC-SHA256 signature validation for Login Widget data and WebApp initData
  • Session cookies and per-request API protection via middleware
  • Telegram Mini App support with initData-based authentication
  • Enforce allowed user IDs to restrict access to trusted accounts

Quick Start

  1. Set up a Telegram bot with BotFather and obtain a bot token.
  2. Link your domain with BotFather using /setdomain and ensure domain matches where your login widget is hosted.
  3. Implement backend validation for both Telegram Login Widget data and WebApp initData using SHA256(bot_token) and HMAC-SHA256("WebAppData", bot_token) respectively.
  4. Inject bot username into your frontend and render the Telegram Login Widget.
  5. Handle the login callback to create a secure session cookie and protect API endpoints with the middleware.

Frequently Asked Questions about telegram-web-login

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement Telegram login for a web app?▼

Telegram login for a web app is enabled by integrating the Telegram Login Widget on your frontend and validating user signatures on your backend using SHA256-based verification to securely authenticate users.

How does Telegram Mini App initData authentication work?▼

Telegram Mini App initData authentication works by validating the initData payload using HMAC-SHA256 with the WebAppData string and your bot token to securely verify user identity for your application.

Can I restrict Telegram authentication to specific allowed user IDs?▼

Yes, you can restrict Telegram authentication by enforcing an allowlist of trusted Telegram user IDs in your backend validation logic, ensuring only authorized accounts can access your web app.

What do I need to set up before adding Telegram authentication to my website?▼

Before adding Telegram authentication, you need to create a bot with BotFather, obtain a bot token, and link your domain using the /setdomain command to match your widget hosting domain.

How do I protect API endpoints after Telegram web login validation?▼

To protect API endpoints after Telegram web login, you implement a lightweight middleware that validates session cookies and per-request API protection using your bot token and allowed user ID.

Related Skills

Explore More Software Engineering Skills→
simplefarmer69simplefarmer69
2

telegram-bot-manager

Manage Telegram bot registration, token validation, and connectivity checks for OpenClaw.

Community
Intermediate
thejefflarsonthejefflarson
20

csrf

Enforce CSRF tokens on state-changing endpoints across web frameworks.

Community
Advanced
AndVl1AndVl1
4

ktgbotapi-patterns

Design modular ktgbotapi Telegram bot architectures with FSM, Koin DI, and keyboard builders.

Community
Advanced
VKirillVKirill
15

max-bridge

Validates MAX messenger WebAppData initData identity and permissions via HMAC-SHA256 with TTL checks for ru.dev.max.xpi.dev.max.ru RU mini-apps server-side authorization flows endpoint security and Node constant-time comparison troubleshooting guidance. Ensures correct extraction and sorting of WebAppData params excluding hash from launch_params for Node-based RU mini-apps targeting dev.max.ru pla

Community
Advanced