---
title: "Issue a QR code for signing a Telegram account in"
method: POST
path: "/api/v1/credentials/telegram/qr"
tags: ["Credentials"]
---

# Issue a QR code for signing a Telegram account in

`POST /api/v1/credentials/telegram/qr`

## Request

- Base URL: `https://wardenpoint.com` (the document declares no server; this is the origin it was published from)
- URL: `https://wardenpoint.com/api/v1/credentials/telegram/qr`
- Auth: API key in header `X-API-Key`

Connecting a Telegram ACCOUNT (not a bot) takes two things a person has to do: type api_id/api_hash/phone into a link form, and then approve a sign-in from a phone that is already logged into Telegram. This endpoint produces the second one.

The response carries the same login token twice: `qr_svg` is ready-to-embed SVG markup, `login_url` is the `tg://login?token=…` link encoded inside that image. Show whichever your surface can actually render — on a phone the link opens the Telegram confirmation directly, with nothing to scan.

NOT idempotent, and this is the important part: every call mints a NEW login token and kills the previous one. Do not call it on a timer. Call it once, then poll GET /api/v1/credentials/telegram/qr and call this again ONLY when that poll answers `expired`.

Requires api_id, api_hash and phone to be stored already — ask for them with POST /api/v1/credentials/telegram/request first, otherwise this answers 422 saying what is missing.

Two different situations answer 200 with no token, and they are NOT the same: `already_authorized` means the account is connected and there is nothing left to do, while `2fa_required` means an earlier scan already succeeded and the session is waiting for the two-step password. On `2fa_required` do not issue again and do not report the channel as connected — ask for a password link with POST /api/v1/credentials/telegram_2fa/request and poll GET /api/v1/credentials/telegram/qr until it reads `authorized`.

## Response `200`

No token was issued. `status` is `already_authorized` (the account is already signed in — stop here) or `2fa_required` (a scan already succeeded and the two-step password is what is missing — ask for a password link, do NOT issue another QR). qr_svg and login_url are null in both cases.

- object
  - `data` object
    - `status` 'already_authorized' | '2fa_required': `already_authorized` — connected, nothing to do. `2fa_required` — the scan worked, the password is still needed; the credentials are NOT verified yet and calls will not go out until they are.
    - `qr_svg` string, nullable
    - `login_url` string, nullable
    - `expires_in` integer

## Other responses

- `201`: A fresh login token. Show it to the person and start polling.
- `401`: API key missing, invalid, revoked or expired.
- `403`: API key lacks the config.write ability.
- `404`: Secret-entry links are switched off for this installation.
- `422`: Telegram refused to issue a token: api_id/api_hash/phone are not stored yet, the phone number is not usable, or Telegram is rate-limiting this account. The message says which, including the wait in seconds on a flood wait.
- `429`: Too many QR issues in a minute. Each one invalidates the previous code, so this limit protects the person currently scanning.

---

[API](https://skmtc.dev/wardenpoint/apis/wardenpoint-api.md) · [All operations](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/revisions/259ee445728e?raw)