Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe legacy Telegram Login Widget sends signed profile fields to your site, but those fields are not trustworthy just because a browser callback fired. Verify the signature on your server, enforce your own freshness limit, and only then find or create a local account. Telegram now marks the legacy iframe-widget documentation as archived; its current login documentation describes a JavaScript library and OpenID Connect (OIDC), which use different verification rules.
Choose the Telegram flow before writing the verifier
This guide covers the legacy Telegram Login Widget, whose browser-delivered profile fields are authenticated with an HMAC derived from your bot token. Telegram’s current Telegram Login Widget documentation describes the widget as “a simple way to authorize users on your website,” but its newer Log In With Telegram documentation says the legacy iframe-based widget documentation is archived and documents a JavaScript library and OIDC as current options. The supplied official references use the same URL for the legacy and current login documentation; follow the section for the flow you actually implement.
As an Amazon Associate I earn from qualifying purchases.
Do not apply the legacy widget’s bot-token HMAC recipe to an OIDC ID token, or mix it with Telegram Mini App validation. The legacy widget uses signed fields; OIDC uses an ID token whose signature and claims must be validated according to OIDC rules.
Prepare the bot and website domain
A Telegram bot is required. Before displaying the legacy widget, use BotFather’s /setdomain command to associate the website domain with the bot. Telegram’s widget can deliver authentication fields either by redirecting the user to a configured URL or by invoking a configured JavaScript callback.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Both delivery paths are browser-mediated. A redirect’s query parameters and a callback’s JavaScript object are untrusted input until your server validates the proof. Keep the bot token on the server; do not put it in a template, JavaScript bundle, or request sent to the browser.
Verify legacy widget fields in PHP
Telegram’s legacy verification recipe is exact: exclude the received hash, sort the remaining received fields alphabetically by key, format each as key=value, join the lines with a line-feed character, derive the HMAC secret as the SHA-256 hash of the bot token, then calculate HMAC-SHA-256 over the resulting data-check string. Compare its lowercase hexadecimal result with the received hash.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The following function implements that canonicalization for an associative PHP array of the widget’s received fields. It deliberately rejects unexpected input shapes and an empty set of signed fields; confirm the field set for the exact widget integration you have configured.
<?php
function verifyTelegramWidget(array $input, string $botToken): bool
{
if ($botToken === '' || !isset($input['hash']) || !is_string($input['hash'])) {
return false;
}
$receivedHash = $input['hash'];
if (!preg_match('/A[0-9a-f]{64}z/i', $receivedHash)) {
return false;
}
unset($input['hash']);
if ($input === []) {
return false;
}
foreach ($input as $key => $value) {
if (!is_string($key) || (!is_string($value) && !is_int($value))) {
return false;
}
}
ksort($input, SORT_STRING);
$lines = [];
foreach ($input as $key => $value) {
$lines[] = $key . '=' . (string) $value;
}
$dataCheckString = implode("n", $lines);
$secretKey = hash('sha256', $botToken, true);
$expectedHash = hash_hmac('sha256', $dataCheckString, $secretKey);
return hash_equals($expectedHash, strtolower($receivedHash));
}
?>Do not URL-encode values again, trim or normalize whitespace, alter field values, or add a trailing newline before computing the HMAC: any such change produces a different data-check string. The code accepts string and integer values because request parsers can represent numeric-looking fields differently; adapt input parsing carefully so it preserves the original textual values Telegram signed.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enforce freshness separately from signature validity
A valid signature proves that the fields have not been changed; it does not establish that an old signed payload should still be accepted. Telegram’s legacy documentation identifies auth_date as the Unix timestamp when authentication was received and says it can be checked to prevent outdated data, but does not prescribe a numeric age limit.
Choose a maximum age that fits your login flow and document it as an application policy. Reject a missing, malformed, future-dated, or too-old auth_date. For example, after verifying the HMAC, parse auth_date as a nonnegative integer and compare it with the server’s current Unix time using your chosen maximum age. Avoid silently accepting arbitrary ages simply because the signature matches.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Wire validation into Yii2 account handling
Telegram does not prescribe a Yii2-specific implementation. A clear application design is to let a server-side controller receive the configured redirect or callback request, delegate verification and freshness checks to a small service, and proceed to account handling only after both checks pass.
- Receive the request. Configure a Yii2 controller action for the callback or redirect URL and parse the expected widget fields. Do not treat a JavaScript callback as proof of identity.
- Validate the payload. Call a dedicated service that checks required fields, verifies the HMAC, and applies the application’s
auth_dateage limit. Reject missing or malformed fields and failed checks. - Resolve the external identity. Use Telegram’s user
idas the stable external identity key for lookup or account linking. Do not key accounts by display name, username, or other mutable profile text. - Establish the local session. After a verified identity is matched to an existing account or an account is created under your own registration policy, establish the Yii2 application session through the application’s normal authentication flow.
Keep the bot token in server-side configuration or another secret store, not in source-controlled public configuration or view files. Use PHP’s constant-time hash_equals for the expected and received hash comparison. Never log the token, and rotate it if it is disclosed.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
When to use Telegram’s current OIDC flow
If you are starting a new integration, evaluate Telegram’s current login JavaScript library or standard OIDC rather than assuming the archived iframe widget is the recommended path. The OIDC flow has distinct setup and validation requirements:
- Register the relevant allowed URLs with the bot in BotFather.
- Use Authorization Code with PKCE; Telegram recommends the S256 code challenge method.
- Generate and validate
stateon the callback to protect against cross-site request forgery. - Exchange the authorization code server-side, then validate the ID-token signature and claims, including issuer
https://oauth.telegram.org, audience matching the bot Client ID, and an unexpiredexp.
These are not interchangeable with legacy widget checks: an OIDC ID token is not validated by hashing the bot token and comparing a widget hash. Telegram also notes that the telegram-login.js popup communication fails when Cross-Origin-Opener-Policy: same-origin is set; its page suggests removing that header or using same-origin-allow-popups.
Legacy widget and OIDC compared
| Integration | Payload | Verification | Browser and callback behavior | Configuration |
|---|---|---|---|---|
| Legacy Login Widget | Signed profile fields delivered by redirect or JavaScript callback | HMAC-SHA-256 over the sorted data-check string, using SHA-256 of the bot token as the secret | Widget redirect to a configured URL or callback with fields | Link the website domain to the bot with BotFather’s /setdomain |
| Current OIDC login | Authorization code and ID token | Validate the ID-token signature and claims, including issuer, audience, and expiration | Authorization-code flow through the login library or standard OIDC callback; popup behavior may depend on COOP | Configure allowed URLs; use Authorization Code with PKCE and validate state |
Neither flow is universally more secure in every application: the decision depends on the threat model, implementation quality, and whether the site already has reliable OIDC infrastructure. Telegram’s documentation does not establish a Yii2-specific package or compatibility guarantee, so verify any library’s maintenance, supported PHP and Yii2 versions, token-validation behavior, and configuration against Telegram’s current requirements before adopting it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
