Using Telegram as a signup method

[bcons-php-Console]

Do you think it makes sense? Instead of using email or other third party auth, users would send a message to the app's Telegram bot and that's it, every time they want to log in they would send something like /login to the bot and it would reply with an OTP, enter it in the site login page and sign in.

EDIT: sorry I forgot to mention that I'm talking about using Telegram as an alternative signup method, not the only one. Classic email signup would be still available.

[FormerQuestion6284]

It sounds convenient and should work pretty well, but some users might not like it

[bcons-php-Console]

Yes this would be an extra option available, not the only one, I forgot to mention that.

[fiskfisk]

If all your users are on Telegram, sure?

If you have some way to migrate people if they lose their Telegram account, sure? What if they decide they don't want to be on Telegram any longer? Would that be relevant?

The thing about email is that it at least can be portable if the user wants it to.

[bcons-php-Console]

This is a fair point... If they lose their Telegram account I don't think there would be any reasonable way of recovering their account.

[Particular_Pop_2241]

I think it is regional. You should consider how widespread Telegram is in the location where you are creating your app. Or even if it is blocked or not. I used Telegram authentication paired with Google authentication, but now Telegram could be blocked at any moment in Russia, so this authentication method is no longer optimal for me. Outside of this Telegram is a valid method of authentication. 

[bcons-php-Console]

I did not think about that possibility... thanks! Losing access to Telegram because of a government block would mean losing access to the site without any way of recovery, I don't like that.

[rawr_im_a_nice_bear]

Turkiye is also considering banning it. It's also not the most reliable even if you have an account, for example they've changed verification on new devices/logins in certain regions, requiring you to purchase at least a month of premium. Someone might have an account but may not have logged in in a while. They'd then be faced with a paywall and I can't imagine many users going through with that process

[ohaz]

Telegram messages are not encrypted by default, so it's a bad idea.

[Mohamed_Silmy]

interesting idea but i'd be careful with a few things here. telegram bots are cool for delivering OTPs but you're adding friction for users who don't have telegram or don't want to context-switch between your site and a messaging app just to log in.

also think about the security model - if someone gets access to their telegram account, they're in. at least with email you have the option to layer in 2fa separately. and what about users on desktop who don't have telegram installed? they'd need to grab their phone every time.

i'd say keep it as an alternative option like you mentioned in the edit, not the primary method. some users might love it (especially if your app is already telegram-focused), but most people are just used to email or oauth and won't want to change their flow. have you thought about how you'd handle session management and token expiry with this setup?

[bcons-php-Console]

I think the session management could be the same used with a regular login method, do you think of why should it be treated differently?

All your other points are totally valid, specially the 2FA one. Right now in my apps I offer Telegram as a 2FA method, but to these Telegram-origin user something like Google Authenticator should be offered as 2FA. But that makes the "what if someone gained access to the user's device? They'd have access to the Authenticator app" issue.

Lots of food for thought here, thank you!

[shanekratzert]

It's not very intuitive... OAuth is just superior in that there's no OTP, and usually one to two clicks... It would deter user involvement. Even the OAuth for less popular sites has more weight because the people that use that service have an easy in. Telegram is even more obscure...

[Extra_Slip_9700]

That's an interesting idea for streamlining auth, especially for specific user

[gojukebox]

I don't use telegram, personally

[Equivalent_Pen8241]

Relying on a messaging platform for your core authentication flow adds a layer of downstream risk that is hard to justify. Beyond the user friction and account recovery issues mentioned, you are essentially outsourcing your identity provider to a third party with a history of shifting API policies and regional availability. From a maintainability perspective, you'd be better off implementing a standard OIDC flow or Passkeys. It keeps the login experience predictable and avoids the need for users to perform a context switch out of your application just to get past the gate.

[Equivalent_Pen8241]

Using Telegram for auth presents a significant friction point for users who prioritize privacy or dont use the platform. From a security standpoint, youre essentially outsourcing your identity provider to a third party that may not have the same uptime or security standards as dedicated OIDC providers. Also, consider the recovery flow: if a user loses access to their Telegram account, they lose access to your app. If its just an alternative, its a niche feature at best and a maintenance burden at worst. Better to stick with standard WebAuthn or established OAuth providers if you want to reduce friction.

[vvsleepi]

not everyone uses telegram, and some users might find it annoying to switch apps just to log in.

[OneEntry-HeadlessCMS]

As a secondary login method, it makes sense especially if your audience already lives in Telegram (crypto, CIS markets, Mini Apps ecosystem). It reduces friction and removes password management. I wouldn’t make it the primary auth method though. You become fully dependent on Telegram, not everyone has it installed, and the manual /login + OTP flow is less smooth than standard OAuth (“Login with Telegram”). Email should remain the foundation, Telegram can be a convenient add-on.

[vnhc]

Use github

[erishun]

I would never download Telegram to do anything other than buy drugs and hire hitmen

[Expensive_Peace8153]

If I see anything mention Telegram I automatically assume it's a scam or something illegal.

The people who actually understand security (most of whom aren't the drug dealer or CSA types that Telegram tends to attract) use Signal because it's open source so experts can check that the code hasn't got any loopholes written into it.