Signed webhooks for Telegram authentication events
Polling for auth results is wasteful. TeleAuth pushes every send, delivery and verification to your endpoint as a signed JSON event so your system stays in sync in real time.
Event types
Each project can register its own endpoint and secret.
- otp.sent — a code was generated and dispatched
- otp.delivered — Telegram accepted the message
- otp.verified — the user entered a valid code
- otp.failed — delivery or verification failed, with a reason
Verify the signature before you trust the body
Every request carries an HMAC-SHA256 signature computed over the raw body with your webhook secret. Compare it with a timing-safe equality check, and reject anything older than a few minutes to block replays.
Retries and idempotency
Failed deliveries are retried with backoff, so treat events as at-least-once. Key your handler on the event id and ignore duplicates.
Common questions
Which hash is used?
HMAC-SHA256 over the exact raw request body, using the per-project webhook secret.
Do I need a public endpoint?
Yes, the endpoint must be reachable over HTTPS. For local development, use a tunnel and point a development project's webhook at it.
Related guides
More ways to use Telegram for authentication and verification.
Telegram OTP API
Send and verify one-time passwords through Telegram with two REST calls. Project API keys, 5-minute code expiry, signed webhooks and delivery logs.
Telegram bot OTP verification
Step-by-step guide to sending verification codes from your own Telegram bot: create the bot, connect the token, wire the webhook and send your first OTP.
Telegram Login Widget alternative
A Telegram Login Widget alternative you control: no third-party iframe, no domain lock-in. Verify users with your own bot through a simple REST API.
Try telegram webhook authentication with TeleAuth
Create a project, connect your Telegram bot, and send your first OTP in minutes.
Create free account