manzoorwanijk · manzoorwanijk · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/.changeset/lucky-moons-deny.md b/.changeset/lucky-moons-deny.md
@@ -0,0 +1,8 @@
+---
+'@telegram-auth/react': patch
+'@telegram-auth/server': patch
+---
+
+Deprecate the package in favour of Telegram's OpenID Connect login.
+
+See the [migration guide](https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md).
diff --git a/MIGRATION.md b/MIGRATION.md
diff --git a/README.md b/README.md
@@ -1,6 +1,26 @@
 # Telegram Auth
 
-This is a mono-repo for the `@telegram-auth/*` packages. It contains the following packages:
+> [!WARNING]
+>
+> **Deprecated and unmaintained. This repository is archived.**
+>
+> These packages are deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login). Because Telegram now speaks plain OIDC, any OIDC client can talk to it directly — there is nothing left for `@telegram-auth/react` and `@telegram-auth/server` to do.
+>
+> **→ [Migration guide](./MIGRATION.md)**
+>
+> No further releases, bug fixes, or security updates will be published. Issues and pull requests are closed. Existing versions stay on npm so current installs keep working.
+
+This was a mono-repo for the `@telegram-auth/*` packages:
 
 - [`@telegram-auth/react`](./packages/react) - React component for the [Telegram Login Widget](https://core.telegram.org/widgets/login).
 - [`@telegram-auth/server`](./packages/server) - TS/JS class to validate the data received from Telegram Login Widget.
+
+## Where to go instead
+
+| If you were using…                     | Use instead                                                                                                                                                                                       |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@telegram-auth/react` `<LoginButton>` | Telegram's login library, or your own button + an OIDC redirect — see [MIGRATION.md](./MIGRATION.md#2-replace-loginbutton-)                                                                       |
+| `@telegram-auth/server` for login data | Verify the OIDC ID token — see [MIGRATION.md](./MIGRATION.md#3-replace-authdatavalidator)                                                                                                         |
+| `@telegram-auth/server` for Mini Apps  | OIDC does **not** cover `initData` — see [Telegram's docs](https://core.telegram.org/bots/webapps#validating-data-received-via-the-web-app). [Details](./MIGRATION.md#mini-apps-are-not-affected) |
+
+Thanks to everyone who used, reported issues for, and contributed to these packages.
diff --git a/examples/next-auth-app-router/README.md b/examples/next-auth-app-router/README.md
@@ -1,5 +1,15 @@
 # @telegram-auth next-auth App Router Example
 
+> [!WARNING]
+>
+> **Deprecated.** This example wires NextAuth.js to the `@telegram-auth/*` packages, which are deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login).
+>
+> Telegram publishes an OIDC discovery document, so the `AuthDataValidator` wiring this example demonstrates is no longer needed.
+>
+> **→ [Wiring it up](../../MIGRATION.md#4-wiring-it-up)** in the migration guide.
+>
+> Kept for reference only; it is not maintained.
+
 - [NextAuth.js](https://next-auth.js.org/)
 
 ## Get Started

diff --git a/examples/next-auth/README.md b/examples/next-auth/README.md
@@ -1,5 +1,14 @@
 # @telegram-auth next-auth Example
 
+> [!WARNING]
+> **Deprecated.** This example wires NextAuth.js to the `@telegram-auth/*` packages, which are deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login).
+>
+> Telegram publishes an OIDC discovery document, so the `AuthDataValidator` wiring this example demonstrates is no longer needed.
+>
+> **→ [Wiring it up](../../MIGRATION.md#4-wiring-it-up)** in the migration guide.
+>
+> Kept for reference only; it is not maintained.
+
 -   [NextAuth.js](https://next-auth.js.org/)
 
 ## Get Started

diff --git a/examples/remix-basic/README.md b/examples/remix-basic/README.md
@@ -1,5 +1,14 @@
 # @telegram-auth remix-basic example
 
+> [!WARNING]
+> **Deprecated.** This example uses the `@telegram-auth/*` packages, which are deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login).
+>
+> The equivalent is two routes — one that redirects to `https://oauth.telegram.org/auth` with PKCE, one that exchanges the code and verifies the ID token.
+>
+> **→ [Rolling it yourself](../../MIGRATION.md#rolling-it-yourself)** in the migration guide.
+>
+> Kept for reference only; it is not maintained.
+
 -   [Remix Docs](https://remix.run/docs)
 
 ## Get Started

diff --git a/packages/react/README.md b/packages/react/README.md
@@ -1,5 +1,15 @@
 # @telegram-auth/react
 
+> [!WARNING]
+>
+> **Deprecated and unmaintained.**
+>
+> This package is deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login). Replace `<LoginButton />` with Telegram's own login library, or with your own button that starts a standard OIDC redirect.
+>
+> **→ [Migration guide](https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md)**
+>
+> This package still works, but will receive no further releases, bug fixes, or security updates.
+
 [`@telegram-auth/react`](https://www.npmjs.com/package/@telegram-auth/react) exports a React component ([LoginButton](./docs#loginbutton)) to render a Telegram Login button using [Telegram Login Widget](https://core.telegram.org/widgets/login).
 
 ## Documentation

diff --git a/packages/react/src/LoginButton.tsx b/packages/react/src/LoginButton.tsx
@@ -15,6 +15,11 @@ function initTelegramAuthLogin(options: TTelegramAuthLogin) {
 /**
  * A React component that renders a Telegram login button.
  *
+ * @deprecated Unmaintained. Deprecated in favour of Telegram's OpenID Connect login. Replace
+ * this with your own button that starts a standard OIDC redirect — see
+ * https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md
+ *
+ * @see https://core.telegram.org/bots/telegram-login
  * @see https://core.telegram.org/widgets/login
  *
  * @param {LoginButtonProps} props The props to pass to the component.

diff --git a/packages/react/src/createScript.ts b/packages/react/src/createScript.ts
@@ -3,6 +3,10 @@ import { CreateScriptOptions } from './types';
 /**
  * It creates a script tag with the right attributes to load the Telegram widget
  *
+ * @deprecated Unmaintained. Deprecated in favour of Telegram's OpenID Connect login — see
+ * https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md
+ *
+ * @see https://core.telegram.org/bots/telegram-login
  * @see https://core.telegram.org/widgets/login
  *
  * @param {CreateScriptOptions} options - The options to create the script.

diff --git a/packages/server/README.md b/packages/server/README.md
@@ -1,5 +1,17 @@
 # @telegram-auth/server
 
+> [!WARNING]
+>
+> **Deprecated and unmaintained.**
+>
+> This package is deprecated in favour of Telegram's [OpenID Connect login](https://core.telegram.org/bots/telegram-login). With OIDC, login data arrives as a signed ID token, so any OIDC client verifies it for you — no bespoke HMAC validation needed.
+>
+> **→ [Migration guide](https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md)**
+>
+> **Mini App users:** OIDC does **not** replace [`initData` validation](https://core.telegram.org/bots/webapps#validating-data-received-via-the-web-app). If that is why you use `AuthDataValidator`, follow the procedure in [Telegram's Mini Apps docs](https://core.telegram.org/bots/webapps#validating-data-received-via-the-web-app) — see [the migration guide](https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md#mini-apps-are-not-affected).
+>
+> This package still works, but will receive no further releases, bug fixes, or security updates.
+
 _Zero dependency package to validate the data received from Telegram Login Widget or Web App, compatible with Node, serverless edge networks and web workers._
 
 [`@telegram-auth/server`](https://www.npmjs.com/package/@telegram-auth/server) exports a TS/JS class ([`AuthDataValidator`](./docs/classes/AuthDataValidator.md)) to validate the data received from [Telegram Login Widget](https://core.telegram.org/widgets/login#checking-authorization) and [Telegram Web Apps](https://core.telegram.org/bots/webapps#validating-data-received-via-the-web-app).

diff --git a/packages/server/src/AuthDataValidator.ts b/packages/server/src/AuthDataValidator.ts
@@ -39,6 +39,13 @@ export interface AuthDataValidatorOptions {
 /**
  * Validates the data sent by Telegram Login Widget
  *
+ * @deprecated Unmaintained. Deprecated in favour of Telegram's OpenID Connect login, where the
+ * ID token's signature replaces this HMAC check — verify it with any OIDC client instead.
+ * Note that OIDC does **not** cover Mini App `initData` validation; for that, follow the
+ * procedure in Telegram's Mini Apps documentation.
+ * See https://github.com/manzoorwanijk/telegram-auth/blob/main/MIGRATION.md
+ *
+ * @see https://core.telegram.org/bots/telegram-login
  * @see https://core.telegram.org/widgets/login#checking-authorization
  */
 export class AuthDataValidator {