Authorization Without SMS: Telegram Integrates OpenID Connect into Login Widget
Telegram is expanding the functionality of its tool for logging into third-party websites. The updated Login Widget now supports the OpenID Connect protocol, allowing websites to obtain not only user identification but also their phone number and consent to communicate via the messenger. This turns the login button into a universal tool for registration, authentication, and establishing a communication channel.
What Changed in Login Widget
Previously, Telegram's Login Widget allowed users to log into websites using their Telegram account but did not provide developers with flexible options for requesting additional data. With the new update, websites can:
- Request the user's phone number (with their consent).
- Obtain permission to send messages via Telegram.
- Use the standard OpenID Connect protocol for integration.
For developers, this means a simplified authentication process: no longer need to implement their own mechanisms for number verification or message exchange. Telegram takes over these functions, providing a ready-made API.
Technical Details for Developers
The key innovation is support for OpenID Connect, a modern authentication standard built on top of OAuth 2.0. Telegram provides:
- Automatic configuration discovery endpoint:
https://oauth.telegram.org/.well-known/openid-configuration. - Authorization code flow with PKCE (Proof Key for Code Exchange) — enhances security for mobile and single-page applications.
- Client ID and Client Secret, which can be obtained via BotFather.
This allows developers to integrate Telegram login into their projects with minimal effort, using standard OpenID Connect libraries.
What Matters
- Telegram Login Widget now works as a full-fledged OpenID Connect provider.
- Websites can request the phone number and permission to send messages.
- Developers get a standard API for authentication.
- The user's phone number is not disclosed to the website without explicit consent.
- The tool is free and does not require SMS confirmation.
Context and Market Significance
Telegram is not the first messenger to offer authentication features. However, its approach differs: instead of creating a separate login platform, it expands the existing Login Widget, making it part of the ecosystem. This lowers the barrier for developers, who do not need to learn a new API — standard OpenID Connect is sufficient.
For end users, the advantage is that they no longer need to enter SMS codes or remember additional passwords. Authorization happens via Telegram, which is already installed on the device.
In the long term, this could reduce dependence on traditional authentication methods (SMS, email) and strengthen the role of messengers as centers of digital identity. Telegram, with its focus on privacy, offers an alternative where user data is not shared with third parties without their knowledge.
— Editorial Team
No comments yet.