(01)
Passwordless Telegram Login
Your users authenticate with a single tap in Telegram. No passwords to remember, store, or reset — and no email verification flows to maintain.
(Verne Passepartout · Telegram Auth-as-a-Service)
Passwordless Login for Your Users, Powered by Telegram No passwords, no SMS bill, no domain binding
Let your tenant's end-users sign in with a single tap in Telegram. Passepartout handles the bot bridge, tenant-scoped identities, and secure tokens — so you ship authentication without building it.
curl -X POST https://api.vernesoft.com/v1/passepartout/login/start \
-H "Authorization: Bearer vrn_passepartout_•••"
# => { "nonce": "n_9f2c…", "deep_link": "https://t.me/your_bot?start=n_9f2c…" }(The Password Problem)
Why Rolling Your Own Auth Slows You Down
Passwords, email verification, and reset flows are a constant source of friction, support tickets, and security risk. Building them yourself means weeks of work you will maintain forever.
Traditional / In-House Auth
- ✕ Password storage and reset flows you must secure and maintain forever.
- ✕ Email verification delays and deliverability issues block sign-ups.
- ✕ Every tenant's users blur together without hard isolation boundaries.
- ✕ Bot credentials scattered across configs and env files in plaintext.
Verne Software Passepartout
- ✓ Passwordless Telegram login — no passwords to store or leak.
- ✓ Instant sign-in via deep link — no email round-trips.
- ✓ Tenant-scoped identities isolated per tenant in Ory Kratos.
- ✓ Bot tokens encrypted at rest with AES-256-GCM.
(The Official Widget)
What Telegram's Login Widget Cannot Do
The widget is free, official, and it works — inside five limits that are documented, permanent, and hit the moment you have more than one production domain. Passepartout is the same Telegram login without them.
Where it stops
Telegram Login Widget
Verne Passepartout
(01)
Domain Binding
Telegram Login Widget
Bound to one domain you register with BotFather. A staging environment needs a second bot, and the wrong origin fails with "Bot domain invalid".
Verne Passepartout
No domain to register. One bot serves production, staging and every developer machine at once.
(02)
Local Development
Telegram Login Widget
Will not run on localhost, so the login you ship is never the login you tested.
Verne Passepartout
The same deep-link flow runs locally and in production — the user taps Start in your bot either way.
(03)
Sessions And Logout
Telegram Login Widget
Hands back a signed payload and stops there. There is no session, so there is nothing to expire and nothing to log out of.
Verne Passepartout
Returns a session token with an expiry, plus an introspection endpoint to check it on every request.
(04)
The Button
Telegram Login Widget
An iframe you configure rather than markup you control: size, corner radius and the wording Telegram allows, in Telegram's own styling.
Verne Passepartout
You render your own button. The flow is two HTTP calls, so it fits whatever your design system already looks like.
(05)
Signature Checking
Telegram Login Widget
You build the data-check string and verify the HMAC yourself, correctly, in every backend that accepts a login.
Verne Passepartout
Validated on our side before a token is issued. Your backend verifies one token, the same way it does for every other Verne engine.
(Core Features)
Everything You Need to Ship Telegram Auth
(02)
Tenant-Scoped Identities
Every tenant's end-users are fully isolated. Identities live in a shared Ory Kratos, namespaced per tenant, so one customer's users never overlap with another's.
(03)
Drop-In Bot Setup
Create a bot with @BotFather, paste the token into your dashboard, and enable it. Passepartout handles the rest — no public webhook or infrastructure required.
(04)
Deep-Link Login Flow
Start a login to receive a nonce and a t.me deep link. The user taps Start in your bot, and you poll for status until an access token and user profile are returned.
(05)
Encrypted Bot-Token Storage
Bot tokens from @BotFather are encrypted at rest with AES-256-GCM. The bridge uses Telegram long-polling, so you never expose a public webhook endpoint.
(06)
Multi-Language SDKs
Official SDKs for Node, PHP, Python, and Rust ship a first-class passepartout resource, so you can integrate login in minutes from any stack.
(Nautilus Ecosystem)
The Perfect Match with Verne Gate
Passepartout brings your users in through Telegram, while Gate secures your own API keys and admin access. Deliver post-login events reliably with Relay — one platform for identity and infrastructure.
User taps Start in TelegramPassepartout (Bot bridge)Client Application
(Developer Experience)
Add Telegram Login via API
Start a login, share the deep link, and poll for completion — in any language. Validate the returned tokens with a single introspection call.
# 1. Start a login — returns a nonce and a Telegram deep link
curl -X POST https://api.vernesoft.com/v1/passepartout/login/start \
-H "Authorization: Bearer $VERNE_PASSEPARTOUT_KEY" \
-H "Content-Type: application/json"
# => { "nonce": "n_9f2c…", "deep_link": "https://t.me/your_bot?start=n_9f2c…" }
# 2. Poll for status until the user taps Start in your bot
curl "https://api.vernesoft.com/v1/passepartout/login/status?nonce=n_9f2c…" \
-H "Authorization: Bearer $VERNE_PASSEPARTOUT_KEY"
# => { "status": "completed", "access_token": "…", "user": { "id": "…" } }(FAQ)
Frequently Asked Questions
How does the Telegram login flow work?
Your app calls POST /v1/passepartout/login/start to get a nonce and a t.me deep link. The user opens it and taps Start in your bot; your app then polls GET /v1/passepartout/login/status until it returns a completed status with an access token and user profile.
Do I need to run a public webhook for the Telegram bot?
No. The Passepartout bridge connects to Telegram using long-polling, so there is no public webhook to expose or secure. You only configure your bot token from @BotFather in the dashboard.
How are my users kept separate from other tenants?
Every tenant's end-users are namespaced independently in the shared Ory Kratos identity store, and each tenant configures its own Telegram bot. Bot tokens are encrypted at rest with AES-256-GCM.
How is this different from the Telegram Login Widget?
The widget is bound to one domain you register with BotFather, which is why it will not run on localhost; it has no session or logout concept; its button is limited to the options Telegram exposes; and validating the HMAC is your code. Passepartout is a deep-link flow instead: it works from any origin, we validate on our side, and you get back a session token with an expiry you can introspect.
Does it work on localhost?
Yes. There is no domain to register, so the same flow runs in local development and in production — the user taps Start in your bot either way.
Does it cost per message, like SMS one-time codes?
No. Delivery rides Telegram, so there is no per-message cost at all. You pay per API request like every other engine — 3,000 a month free, then €3 per 10,000.
(Get Started Today)
Give Your Users Passwordless Login
Skip the passwords, the email flows, and the maintenance. Ship secure Telegram authentication for your platform today.
What passwordless costs
Passwordless has a price list, and it only becomes obvious in production. SMS one-time codes bill per message in every country, permanently, and the most expensive routes tend to serve the cheapest customers. Magic links move the cost to email: a transactional provider, a warmed domain, and the sign-ups you lose to a spam folder you cannot inspect.
Telegram delivery has neither cost. It arrives in an app the user already has open, there is no per-message charge to pass on, and there is no domain reputation to maintain. What it costs instead is reach — your users have to be on Telegram, which is a real constraint and the honest reason this is one login method rather than the only one.
So the arithmetic is short. Where your audience is already on Telegram, passwordless login stops being a line item at all; where it is not, Gate covers email, password and eleven OIDC providers on the same account. A bot token from @BotFather is the whole setup, and the first 3,000 requests each month are free.