Website login does not grant a Telegram client session
The current Telegram Login reference covers a login library and OpenID Connect, with the legacy iframe widget archived separately. Registering allowed URLs and validating ID tokens establishes website identity; it does not automatically grant a session that reads chats.
Client-side URL authorization also has origin and context rules. Do not pass arbitrary links into authorization methods.
Passport shares explicitly requested data
Users choose and authorize identity-document sharing. The receiving service decrypts supplied data with its own key. Bot-side reception and client-side submission differ; follow the correct encoding and integrity checks rather than treating Base64 decoding as validation.
Integration recommendations
Decide whether ordinary identity or documents are actually needed. Minimize scope, match callbacks strictly and validate issuer, audience, expiry and the current login transaction. Establish a restricted local session and provide revocation and deletion paths.
Passport is not inherently required for support or API ID applications.