> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in from the Telegram Mini App

> Exchanges Telegram WebApp `initData` for a session. The HMAC is checked against the bot token and `auth_date` must be under an hour old. Only works for a Telegram account already linked in Settings — this never creates an account. If the account has a second factor, returns a pre-auth token instead of a session. Any failure from the account lookup (not linked, banned) is a 401 carrying the reason. Not rate-limited.



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/auth/telegram-miniapp
openapi: 3.1.0
info:
  title: Server.Express API
  version: 1.0.0
  description: >-
    The customer-facing Server.Express API: auth, billing, tickets, cloud and
    dedicated servers, hosting, reselling and account management. Every response
    uses the `{ success, data | error }` envelope.
  contact:
    name: Server.Express
    url: https://server.express
servers:
  - url: https://my.server.express/api
    description: Production
security:
  - bearerAuth: []
  - apiToken: []
tags:
  - name: API Tokens
  - name: Account
  - name: Auth
  - name: Cloud
  - name: Coupons
  - name: Credits
  - name: Dashboard
  - name: Dedicated
  - name: Health
  - name: Hosting
  - name: Integrations
  - name: Invoices
  - name: Livechat
  - name: Notifications
  - name: Passkeys
  - name: Payments
  - name: Products
  - name: Public
  - name: Public Invoices
  - name: Public Tools
  - name: Reseller
  - name: SSH Keys
  - name: Services
  - name: Tasks
  - name: Teams
  - name: Tickets
  - name: Web Hosting
  - name: Webhooks
paths:
  /v1/auth/telegram-miniapp:
    post:
      tags:
        - Auth
      summary: Sign in from the Telegram Mini App
      description: >-
        Exchanges Telegram WebApp `initData` for a session. The HMAC is checked
        against the bot token and `auth_date` must be under an hour old. Only
        works for a Telegram account already linked in Settings — this never
        creates an account. If the account has a second factor, returns a
        pre-auth token instead of a session. Any failure from the account lookup
        (not linked, banned) is a 401 carrying the reason. Not rate-limited.
      operationId: publicAuthTelegramMiniapp
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - initData
              properties:
                initData:
                  type: string
                  description: >-
                    The raw `Telegram.WebApp.initData` query string, including
                    `hash`, `auth_date` and `user`.
      responses:
        '200':
          description: Signed in, or a second factor is required.
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                properties:
                  success:
                    type: boolean
                    const: true
                  data:
                    oneOf:
                      - $ref: '#/components/schemas/PublicAuthOAuthSession'
                      - $ref: '#/components/schemas/PublicAuthTwoFactorChallenge'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
      security: []
components:
  schemas:
    PublicAuthOAuthSession:
      type: object
      description: >-
        Session issued by an OAuth or Telegram Mini App sign-in. The user object
        also carries `bannedAt`.
      required:
        - accessToken
        - refreshToken
        - user
      properties:
        accessToken:
          type: string
        refreshToken:
          type: string
        user:
          allOf:
            - $ref: '#/components/schemas/PublicAuthSessionUser'
            - type: object
              properties:
                bannedAt:
                  type:
                    - string
                    - 'null'
                  format: date-time
                  description: Always null here — a banned account never gets this far.
    PublicAuthTwoFactorChallenge:
      type: object
      description: >-
        The first factor worked but the account has a second. No session yet —
        finish with /v1/auth/2fa/code or the passkey pair /v1/auth/2fa/options +
        /v1/auth/2fa/verify.
      required:
        - twoFactorRequired
        - preAuthToken
        - methods
      properties:
        twoFactorRequired:
          type: boolean
          const: true
        preAuthToken:
          type: string
          description: >-
            Short-lived JWT that's only good for the /v1/auth/2fa/* sign-in
            routes.
        methods:
          type: object
          description: Which second factors to offer.
          required:
            - passkey
            - totp
            - backupCode
          properties:
            passkey:
              type: boolean
            totp:
              type: boolean
            backupCode:
              type: boolean
              description: True when at least one unused backup code remains.
    PublicAuthSessionUser:
      type: object
      required:
        - id
        - email
        - firstName
        - lastName
        - role
      properties:
        id:
          type: string
          format: uuid
        email:
          type: string
          format: email
        firstName:
          type: string
        lastName:
          type: string
        role:
          type: string
          enum:
            - CLIENT
            - ADMIN
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
      additionalProperties: true
  responses:
    BadRequest:
      description: Validation failed or the request is malformed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, invalid or expired credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh.
        A session satisfies every API scope.
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: se_live_<prefix>_<secret>
      description: >-
        Personal API token created under Settings → API tokens. Only routes
        guarded by verifyApiAuth accept it, and the token must carry the scope
        named in the operation's x-required-scope.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.