Telegram.Login.init({
client_id: ВАШ_CLIENT_ID,
request_access: ['phone']
}, function(data) {
if (data.error) {
console.error(data.error);
return;
}
// data.id_token содержит JWT с данными пользователя
// data.user — уже декодированные данные
});<script
src="https://telegram.org/js/telegram-widget.js?2"
data-telegram-login="ИМЯ_ВАШЕГО_БОТА"
data-size="medium"
data-auth-url="https://example.com/auth/callback"
data-request-access="write">
</script>function checkTelegramAuthorization($auth_data) {
$check_hash = $auth_data['hash'];
unset($auth_data['hash']);
$data_check_arr = [];
foreach ($auth_data as $key => $value) {
$data_check_arr[] = $key . '=' . $value;
}
sort($data_check_arr);
$data_check_string = implode("\n", $data_check_arr);
$secret_key = hash('sha256', BOT_TOKEN, true);
$hash = hash_hmac('sha256', $data_check_string, $secret_key);
if (strcmp($hash, $check_hash) !== 0) {
throw new Exception('Данные не от Telegram');
}
if ((time() - $auth_data['auth_date']) > 86400) {
throw new Exception('Данные устарели');
}
return $auth_data;
}import hashlib
import hmac
def verify_telegram_login_hash(data: dict, bot_token: str) -> bool:
check_hash = data.pop('hash')
data_check_string = "\n".join(
f"{k}={v}" for k, v in sorted(data.items()) if v is not None
)
secret_key = hashlib.sha256(bot_token.encode()).digest()
computed = hmac.new(secret_key, data_check_string.encode(), hashlib.sha256).hexdigest()
return hmac.compare_digest(computed, check_hash){
"iss": "https://oauth.telegram.org",
"aud": "123456789",
"sub": "1234123412341234123",
"iat": 1700000000,
"exp": 1700003600,
"name": "Иван Петров",
"preferred_username": "ivanpetrov",
"picture": "https://cdn4.telesco.pe/file/...",
"phone_number": "79991234567"
}@auth_router.get('/telegram-callback')
async def telegram_callback(request: Request, user_id: int, query_hash: str, next_url: str = '/'):
# Проверяем подпись
params = request.query_params.items()
data_check_string = '\n'.join(sorted(f'{k}={v}' for k, v in params if k not in ('hash', 'next')))
computed_hash = hmac.new(BOT_TOKEN_HASH.digest(), data_check_string.encode(), 'sha256').hexdigest()
if not hmac.compare_digest(computed_hash, query_hash):
return PlainTextResponse('Ошибка авторизации', status_code=401)
# Создаём JWT и ставим куки
token = jwt.encode({'alg': 'HS256'}, {'k': user_id}, JWT_SECRET_KEY)
response = RedirectResponse(next_url)
response.set_cookie(key='auth-token', value=token)
return response