README.md

@telegram-auth/server

Warning

Deprecated and unmaintained.

This package is deprecated in favour of Telegram's OpenID Connect login. With OIDC, login data arrives as a signed ID token, so any OIDC client verifies it for you — no bespoke HMAC validation needed.

→ Migration guide

Mini App users: OIDC does not replace initData validation. If that is why you use AuthDataValidator, follow the procedure in Telegram's Mini Apps docs — see the migration guide.

This package still works, but will receive no further releases, bug fixes, or security updates.

Zero dependency package to validate the data received from Telegram Login Widget or Web App, compatible with Node, serverless edge networks and web workers.

@telegram-auth/server exports a TS/JS class (AuthDataValidator) to validate the data received from Telegram Login Widget and Telegram Web Apps. It also exports some utility functions to prepare the data for validation.

Documentation

• Reference

Install

# npm
npm install @telegram-auth/server

# yarn
yarn add @telegram-auth/server

# with pnpm
pnpm add @telegram-auth/server

Usage

import { AuthDataValidator } from '@telegram-auth/server';
import { urlStrToAuthDataMap } from '@telegram-auth/server/utils';

// initialize the validator with your bot token
const validator = new AuthDataValidator({ botToken: process.env.BOT_TOKEN });

// convert the data from the URL to a map
const data = urlStrToAuthDataMap(request.url);

try {
    // validate the data by passing the map to the validator
    const user = await validator.validate(data);

    // The data is now valid and you can sign in the user.

    console.log(user);
} catch (error) {
    console.error(error);
}