---
title: "Check how the Telegram sign-in is going"
method: GET
path: "/api/v1/credentials/telegram/qr"
tags: ["Credentials"]
---

# Check how the Telegram sign-in is going

`GET /api/v1/credentials/telegram/qr`

## Request

- Base URL: `https://wardenpoint.com` (the document declares no server; this is the origin it was published from)
- URL: `https://wardenpoint.com/api/v1/credentials/telegram/qr`
- Auth: API key in header `X-API-Key`

Poll this while the person has the QR in front of them. Reading it has no side effect other than marking the credentials verified once the sign-in completes.

FOUR states, and the difference between them is the whole point of this endpoint — collapsing them into "done / not done" loses exactly the information you are polling for:

`waiting` — nobody has approved the sign-in yet. Keep polling; do not touch the POST endpoint.
`authorized` — done. The account is signed in and its credentials are now verified. Stop polling.
`2fa_required` — THE SCAN SUCCEEDED. The account has two-step verification on, so one more thing is needed: the password. Do NOT issue a new QR here — re-issuing throws away the successful scan and sends the person back to scanning in a loop, which is the single most likely way to misuse this API. Ask for a link instead: POST /api/v1/credentials/telegram_2fa/request, show it, and poll that request. The password never travels through you. When it reads verified, this endpoint will read `authorized`.
`expired` — the token you issued died before anyone approved it. This is the ONLY state that means "issue a new QR". Poll for this state rather than timing it yourself: the server knows when the token it handed out dies and you do not, and a hardcoded countdown has already shipped a QR that stayed on screen forever after expiry.

## Response `200`

Current state of the sign-in.

- object
  - `data` object
    - `status` 'waiting' | 'authorized' | '2fa_required' | 'expired': See the description above — `2fa_required` is a success, not a failure, and `expired` is the only reason to issue a new code.

## Other responses

- `401`: API key missing, invalid, revoked or expired.
- `403`: API key lacks the config.write ability.
- `404`: Secret-entry links are switched off for this installation.
- `422`: The Telegram session could not be opened at all — usually api_id/api_hash/phone are missing. The message says which.
- `429`: Polling faster than once a second. Each poll opens the account's Telegram session, which the voice-call workers share — back off rather than tightening the loop.

---

[API](https://skmtc.dev/wardenpoint/apis/wardenpoint-api.md) · [All operations](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/revisions/259ee445728e?raw)