<p>Bots or Telegram websites may <ahref="/bots/api#loginurl">ask users to login to a certain website via Telegram</a> when clicking on certain links or URL buttons in inline keyboards.</p>
<p>When the user clicks on <ahref="/constructor/keyboardButtonUrlAuth">keyboardButtonUrlAuth</a>, <ahref="/method/messages.requestUrlAuth">messages.requestUrlAuth</a> should be called, providing the <code>button_id</code> of the button and the ID and peer of the container message.
The returned <ahref="/constructor/urlAuthResultRequest">urlAuthResultRequest</a> object will contain more details about the authorization request:</p>
<ul>
<li>The <code>domain</code> parameter will contain the domain name of the website on which the user will log in (example: <em>comments.app</em>).</li>
<li>The <code>bot</code> parameter will contain info about the bot which will be used for user authorization (example: <em>DiscussBot</em>).</li>
<li>The <code>request_write_access</code> will be set if the bot would like to send messages to the user.</li>
<p>If the user agrees to login to the URL, <ahref="/method/messages.acceptUrlAuth">messages.acceptUrlAuth</a> should be called (eventually setting the <code>write_allowed</code> if the permission was requested and the user consented).
The result will be a <ahref="/constructor/urlAuthResultAccepted">urlAuthResultAccepted</a> with the final URL to open, which will include a query string with the requested info and a hash that <ahref="/widgets/login#receiving-authorization-data">must be verified upon receival by the service</a>.</p>
<p><ahref="/constructor/urlAuthResultDefault">urlAuthResultDefault</a> could also be returned, instead, in which case the <code>url</code> of the <ahref="/constructor/keyboardButtonUrlAuth">keyboardButtonUrlAuth</a> must be opened, instead.
The same must be done if the user opens the link while refusing the authorization request.</p>
<p>Telegram supports automatic authorization on certain websites upon opening an HTTP URL in-app, upon clicking a link in a message or clicking on a <ahref="/constructor/keyboardButtonUrl">keyboardButtonUrl</a>.</p>
<p>Clients should automatically authenticate users when opening official Telegram websites, listed in the <code>url_auth_domains</code> key of the <ahref="/api/config#client-configuration">client configuration object »</a>. </p>
<p>Upon clicking a link, the URL must be modified by appending the <code>autologin_token</code> from the <ahref="/api/config#client-configuration">client configuration object »</a> to the <ahref="https://datatracker.ietf.org/doc/html/rfc3986#section-3.4">query string</a>, like so: </p>
<p>Make sure that the used <code>autologin_token</code> is no more than <code>10000</code> seconds old, if it is older it must be refetched before use as described in the <ahref="/api/config#client-configuration">client configuration section »</a>. </p>
<p>Clients should show a confirmation prompt similar to the one used <ahref="#bot-url-authorization">for bots</a>, to authenticate users when opening certain Telegram websites, listed in the <code>url_auth_domains</code> key of the <ahref="/api/config#client-configuration">client configuration object »</a>. </p>
<p><ahref="/method/messages.requestUrlAuth">messages.requestUrlAuth</a> should be called, providing only the original <code>url</code>.
The returned <ahref="/constructor/urlAuthResultRequest">urlAuthResultRequest</a> object will contain more details about the authorization request:</p>
<ul>
<li>The <code>domain</code> parameter will contain the domain name of the website on which the user will log in (example: <em>comments.app</em>).</li>
<li>The <code>request_write_access</code> will be set if the website would like to send messages to the user.</li>
</ul>
<p>The info should be shown in a prompt. </p>
<p>If the user agrees to login to the URL, <ahref="/method/messages.acceptUrlAuth">messages.acceptUrlAuth</a> should be called (eventually setting the <code>write_allowed</code> if the permission was requested and the user consented).
The result will be a <ahref="/constructor/urlAuthResultAccepted">urlAuthResultAccepted</a> with the final URL to open. </p>
<p><ahref="/constructor/urlAuthResultDefault">urlAuthResultDefault</a> could also be returned, instead, in which case the original URL must be opened, instead.
The same must be done if the user opens the link while refusing the authorization request.</p>
