Telegram Code
Phone sign-in with a 6-digit code delivered by your own Telegram bot instead of SMS. Set up the bot in Abrova Console; users share their number with the bot once, then receive codes there.
The user enters a phone number and receives a 6-digit sign-in code from your project's Telegram bot. Where Telegram is common, it replaces SMS at no cost per message. Telegram confirms the number belongs to the user's Telegram account, so a code only ever goes to the owner of that number.
Telegram is filtered in Iran but widely used, and it does not depend on Google or Apple. Users without Telegram need another method, such as e-mail or magic link.
Create and connect a bot#
- In Telegram, talk to @BotFather, send
/newbot, and pick a name and username for your bot (for exampleMyAppLoginBot). BotFather gives you a bot token. - In Abrova Console, open Abrova Auth › Sign-in methods, turn on Telegram, and paste the bot token.
Abrova Auth checks the token with Telegram and connects the bot. The token is stored encrypted and never shown again. Use the bot for Abrova Auth only: Abrova takes over its incoming messages.
How the user signs in#
- 1The user enters a phone numberIn international format, for example +989121234567. Your app calls requestTelegramCode.
- 2First time only: the user connects the botIf this number has not talked to your bot yet, the answer has sent: false and a botUrl. Open it: the user presses Start and taps "Share my phone number".
- 3The code arrives in TelegramA 6-digit code, valid for 5 minutes. After the first time, codes arrive right away (sent: true).
- 4The user types the codeYour app calls verifyTelegramCode with the number and the code.
The bot accepts only the user's own number, shared with Telegram's button. A forwarded contact of someone else is refused.
Code#
// Flutter
final auth = AbrovaAuth.instance;
final r = await auth.requestTelegramCode('+989121234567');
if (!r.sent && r.botUrl != null) {
await launchUrl(Uri.parse(r.botUrl!)); // url_launcher: the user starts the bot and shares the number
}
// ... the user types the code from Telegram:
await auth.verifyTelegramCode('+989121234567', code);// iOS
let r = try await AbrovaAuth.shared.requestTelegramCode(phone: "+989121234567")
if !r.sent, let url = r.botURL { await UIApplication.shared.open(url) }
try await AbrovaAuth.shared.verifyTelegramCode(phone: "+989121234567", code: code)// Android
val r = AbrovaAuth.shared.requestTelegramCode("+989121234567")
if (!r.sent) startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(r.botUrl)))
AbrovaAuth.shared.verifyTelegramCode("+989121234567", code)// Web and React Native
const { sent, botUrl } = await auth.requestTelegramCode({ phone: '+989121234567' });
if (!sent && botUrl) window.open(botUrl); // React Native: Linking.openURL(botUrl)
await auth.verifyTelegramCode({ phone: '+989121234567', code });The first successful code for a number creates the user. Later codes for that number sign in to the same user.
Rules#
| Rule | Value |
|---|---|
| Code | 6 digits, valid for 5 minutes |
| Attempts | 5 per code; then request a new one |
| Codes per number | 5 per hour |
| Phone format | International, with + and the country code |
getMethods() returns the bot's username as telegramBot when Telegram is on, if you want to show it ("Codes come from @MyAppLoginBot").
Errors#
| Code | Meaning |
|---|---|
| INVALID_CREDENTIALS | The code is wrong, expired, or out of attempts. |
| INVALID_INPUT | The phone number is not in international format, or the code is not 6 digits. |
| RATE_LIMITED | Too many codes for this number or from this place. Try again after retryAfterSec. |
| NOT_CONFIGURED | Telegram is on, but no bot is connected. |
| USER_DISABLED | You disabled this user in the Console. |
| METHOD_DISABLED | Telegram sign-in is off for the project. |