> ## Documentation Index
> Fetch the complete documentation index at: https://omniflow-vpn.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Post v1accountauthtelegram

> Verifies a Telegram Login Widget payload. The hash is checked against the bot token and the auth_date must be recent, so a captured payload cannot be replayed indefinitely. The body is the object the widget hands to its `data-onauth` callback, posted as is: `id` and `auth_date` are JSON numbers, the other fields strings. Like every session-opening POST under /v1/account/auth, it requires Content-Type application/json and refuses a request a browser marks as cross-site (403 cross_origin_request), so a third-party page cannot sign a visitor into another account.



## OpenAPI

````yaml https://raw.githubusercontent.com/kewldan/omniflow/main/api/openapi.yaml post /v1/account/auth/telegram
openapi: 3.0.3
info:
  title: Omniflow API
  version: 1.0.0
  description: >-
    Customer, commerce, payment, wallet, fulfillment, and operations API for
    Omniflow.
servers: []
security: []
paths:
  /v1/account/auth/telegram:
    post:
      tags:
        - account
      description: >-
        Verifies a Telegram Login Widget payload. The hash is checked against
        the bot token and the auth_date must be recent, so a captured payload
        cannot be replayed indefinitely. The body is the object the widget hands
        to its `data-onauth` callback, posted as is: `id` and `auth_date` are
        JSON numbers, the other fields strings. Like every session-opening POST
        under /v1/account/auth, it requires Content-Type application/json and
        refuses a request a browser marks as cross-site (403
        cross_origin_request), so a third-party page cannot sign a visitor into
        another account.
      operationId: accountSignInWithTelegram
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TelegramLoginWidgetPayload'
      responses:
        '200':
          description: Signed in
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountSignIn'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '404':
          $ref: '#/components/responses/Problem'
        '415':
          $ref: '#/components/responses/Problem'
      security: []
components:
  schemas:
    TelegramLoginWidgetPayload:
      type: object
      description: >-
        The document Telegram's Login Widget produces. Every field except `hash`
        participates in the signature in its textual form, so the server keeps
        the digits of the numeric fields verbatim rather than parsing them as
        floating point.
      required:
        - id
        - auth_date
        - hash
      properties:
        id:
          type: integer
          format: int64
          description: The Telegram user ID.
        auth_date:
          type: integer
          format: int64
          description: Unix seconds at which Telegram signed the payload.
        hash:
          type: string
          description: HMAC-SHA256 over the other fields under SHA-256 of the bot token.
        first_name:
          type: string
        last_name:
          type: string
        username:
          type: string
        photo_url:
          type: string
      additionalProperties: true
    AccountSignIn:
      type: object
      required:
        - customer
        - expiresAt
      properties:
        customer:
          $ref: '#/components/schemas/AccountCustomer'
        expiresAt:
          type: string
          format: date-time
    AccountCustomer:
      type: object
      required:
        - id
        - locale
        - timezone
        - status
      properties:
        id:
          type: string
          format: uuid
        locale:
          type: string
          enum:
            - ru
            - en
        timezone:
          type: string
        status:
          type: string
          enum:
            - active
            - suspended
            - deleted
    Problem:
      type: object
      required:
        - type
        - title
        - status
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        request_id:
          type: string
  responses:
    Problem:
      description: Request failed
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.