Significant-Gravitas/AutoGPT · error · HTTPException

Telegram login data failed verification.

Error message

Telegram login data failed verification.

What it means

Raised by the platform-linking confirm route's _verified_platform_user helper when Telegram login data is present on the request but fails cryptographic verification against the bot token (verify_login returns None). It's a 403: the supplied Telegram authentication payload is not trustworthy for that bot.

Source

Thrown at autogpt_platform/backend/backend/api/features/platform_linking/routes.py:60

    Path(max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
]


class ConfirmLinkRequest(BaseModel):
    """Optional confirm payload. ``telegram_auth`` carries the signed identity
    Telegram appends when the user reached this page via a login_url button —
    when present it must verify, and the link token must belong to that same
    Telegram user."""

    telegram_auth: dict[str, str] | None = Field(default=None)


def _verified_platform_user(body: ConfirmLinkRequest | None) -> str | None:
    if body is None or not body.telegram_auth:
        return None
    verified = verify_login(body.telegram_auth, telegram_config.get_bot_token())
    if verified is None:
        raise HTTPException(
            status_code=403, detail="Telegram login data failed verification."
        )
    return verified


def _translate(exc: Exception) -> HTTPException:
    if isinstance(exc, NotFoundError):
        return HTTPException(status_code=404, detail=str(exc))
    if isinstance(exc, NotAuthorizedError):
        return HTTPException(status_code=403, detail=str(exc))
    if isinstance(exc, LinkAlreadyExistsError):
        return HTTPException(status_code=409, detail=str(exc))
    if isinstance(exc, LinkTokenExpiredError):
        return HTTPException(status_code=410, detail=str(exc))
    if isinstance(exc, LinkFlowMismatchError):
        return HTTPException(status_code=400, detail=str(exc))
    return HTTPException(status_code=500, detail="Internal error.")

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Regenerate the Telegram login data (re-trigger the Telegram login widget) so the hash and auth_date are fresh, then retry immediately.
2. Verify TELEGRAM_BOT_TOKEN on the backend matches the bot that issued the login payload.
3. Check server clocks — auth_date freshness checks fail with significant skew.
4. For tests, construct the hash correctly with HMAC-SHA256 over the data-check-string using the bot token.

Example fix

# before — replaying old widget data
body.telegram_auth = staleWidgetData
# after — always collect fresh data at confirm time
data = Telegram.LoginWidget.auth();  # fresh, then POST immediately
body.telegram_auth = data;

// Client: check freshness before sending telegram_auth
const auth = Telegram.LoginWidget.auth();
if (Date.now() / 1000 - Number(auth.auth_date) > 300) {
  throw new Error('Telegram login data stale — re-authenticate');
}
await confirmLink({ telegram_auth: auth });

function isFreshTelegramAuth(a: Record<string, string>): boolean {
  const age = Date.now() / 1000 - Number(a.auth_date);
  return Number.isFinite(age) && age < 300 && Boolean(a.hash);
}

try { await confirmLink(body); }
catch (e) {
  if (e.status === 403 && e.detail?.includes('verification')) {
    await retriggerTelegramLogin(); // get fresh widget data, retry once
  } else throw e;
}

When it happens

Trigger: POSTing a confirm-link request whose telegram_auth dict was tampered with, built with the wrong bot's data, signed with an outdated hash scheme, or whose auth_date is outside the allowed window; also when the backend's telegram_config bot token doesn't match the bot that produced the widget data.

Common situations: Frontend forwarding stale Telegram widget data (old auth_date) captured hours earlier; backend configured with a different TELEGRAM_BOT_TOKEN than the bot used at login; clock skew between servers; manually crafted requests in tests without valid hashes.

Related errors

• The ChatGPT verification link is invalid. Close this window
• Authentication failed — please sign in again.
• Authentication error — please sign in again.
• job belongs to a different user
• OAuth2 callback failed to exchange code for tokens: {str(e)}

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/1b01b5edb367043f. Report an issue: GitHub.