🔐 Cryptographic HMAC-SHA256 Verification
Telegram Authentication Console
Demonstrating the full flow: frontend widget approval, secure HTTPS payload transfer, backend HMAC-SHA256 signature validation, and JWT session issuance.
🚀 Official Telegram Widget
@StudyBroTalTech_bot
The official Telegram login button. When authorized on your configured domain (Lovable or localhost), Telegram provides a signed payload.
💡 Note: For this widget to render on local browsers, your bot's domain in @BotFather must be set to
localhost or tested directly from your Lovable deployment.
🧪 Cryptographic Test Sandbox
Developer Tool
Test the backend verification algorithm instantly. Send genuine signatures or simulate attack vectors to see how the server responds:
⚡ Verification Pipeline
Idle
Frontend receives signed payload from Telegram
POST payload over HTTPS to
/api/auth/telegram
Backend derives secret key:
SHA256(bot_token)
Rebuilds sorted
key=value\n data-check-string
Timing-safe comparison:
hmac.compare_digest
Replay protection:
auth_date freshness check
Session issued: Signed JWT Bearer token returned
👤 Authenticated Session
Not Logged In
Authenticate via Telegram or click the simulator to establish a secure session.
🔍 Payload & JWT Inspector
// Awaiting incoming payload...