The project My Anti-Social Network shows how to implement legally compliant entry into Telegram Mini Apps for Russian audiences by moving identity verification away from Telegram itself. While Telegram’s initData HMAC-SHA-256 signature check remains reliable, Russian regulatory demands for user identification require additional steps when the service targets domestic users.
The core design separates identity (who the user is) from channel identity (where notifications are delivered). Users authenticate via VK ID, Yandex ID, or MAX; the resulting telegram_id is stored only as a delivery channel, never as the primary login credential.
VK ID Flow with PKCE
For VK ID the application follows OAuth 2.1 with PKCE. The browser generates a code_verifier, derives a code_challenge using S256, and stores the verifier on the server under a cryptographically random state value. The authorization URL opens in a new tab so users can complete login even when the Mini App runs inside Telegram WebView or on another device.
Yandex ID and MAX Integration
Yandex ID uses a similar OAuth 2.0 redirect that returns a short-lived code exchanged server-side for an identifier. MAX authentication relies on a one-time deep-link token that the MAX bot confirms inside the chat. In all cases the final exchange endpoint issues an HttpOnly session cookie; OAuth tokens never become accessible to client-side JavaScript.
Security Controls
- state values are generated with crypto.randomUUID() or equivalent 128-bit entropy and carry short TTLs.
- Polling for authentication results uses up to 120 attempts with 3-second intervals.
- Consent checkboxes for data processing are shown according to the platform (two checkboxes inside Telegram WebApp, one in PWA).
The same codebase powers Telegram bots, MAX and VK bots, PWA, browser extensions, and Home Assistant voice-assistant integrations with Alice, Sber, and Marusya. All state, code exchange, and polling logic remains invisible to the end user.
