Two-step verification is a separate password check
Telegram uses SRP for the additional password check. Use a maintained library and the supplied algorithm parameters rather than sending a password to an invented HTTP endpoint. Distinguish waiting for a code, waiting for a password and successful authorization: accepting a code may not finish login.
QR login requires an authorized device
A login token expires. After an already-authorized device accepts it, the requesting client must handle the authorization result and possible DC migration. Refresh an expired token rather than merely repainting the old QR image. QR login is not a way to register a new number without verification.
Passkey eligibility matters
The reviewed official reference says unofficial applications cannot currently use passkey login because other RP IDs are disallowed. An account’s two-step password can still be required in the supported official flow. Showing a system passkey dialog alone does not establish integration.
Design the state transitions explicitly
Display the actual requested action rather than promising SMS in advance. Treat timeout, cancellation and retry separately. Record state and sanitized errors, never passwords or complete QR login tokens.