Automattic

Manzoor Wani

Gergely J

<p>Sign in with Telegram lets your visitors log in with their Telegram account — no extra password to remember, no new account to create. Unlike older Telegram-login plugins that rely on a script embedded from Telegram (which modern privacy-focused browsers often block), this plugin uses <a href="https://core.telegram.org/bots/telegram-login" rel="nofollow ugc">Telegram’s standard OpenID Connect login</a>: a secure redirect to Telegram and back. It works reliably in every browser, including ones with strict tracker blocking turned on.</p>
<h4>Features</h4>
<ul>
<li><strong>“Sign in with Telegram” button</strong> on the standard <code>wp-login.php</code> screen, as a <code>[telegram_signin_button]</code> shortcode anywhere on your site, or as a Block Editor block.</li>
<li><strong>Account linking</strong> from the user profile screen — existing WordPress users can connect or disconnect their Telegram account.</li>
<li><strong>Profile sync</strong> — display name and avatar from the user’s Telegram profile flow through to the WordPress profile automatically.</li>
<li><strong>No automatic account merging</strong> — a Telegram identity can only attach to an existing WordPress user through an explicit click-to-link action from a logged-in session, so a stranger who happens to share an email address can never take over an account.</li>
<li><strong>Secure by default</strong> — uses the same kind of modern, signed redirect flow that “Sign in with Google” and “Sign in with Apple” use. No shared bot-token secret on your server, no manual key rotation.</li>
<li><strong>Settings page</strong> in wp-admin where you paste the bot’s Client ID + Client Secret, pick the default role for new users, and optionally collect the visitor’s verified phone number or request permission for your bot to message them directly.</li>
</ul>
<h4>How it compares to the legacy Login Widget</h4>
<p>Telegram’s older Login Widget (used by most existing Telegram-login plugins on the directory) is <strong>not</strong> OAuth or OpenID Connect. It loads a JavaScript file from telegram.org that renders Telegram’s button on your page and then hands the auth result either to a JavaScript callback or to a server URL. Either mode still needs the embedded script to render the button in the first place. That setup is increasingly fragile:</p>
<ul>
<li>Browsers with strict third-party-script blocking — Brave with default shields, Firefox Enhanced Tracking Protection on Strict, Safari Lockdown Mode, uBlock Origin filter lists — frequently block the embedded script outright, so the button never renders and visitors have no way to start the flow.</li>
<li>The widget’s authentication hash is an HMAC-SHA256 over your bot token, so anyone who wants to verify a login has to hold a copy of that secret. There’s no standard JWT / JWKS story to lean on.</li>
<li>Key rotation is manual — changing the HMAC key means rotating the bot token in BotFather and updating it on every server that verifies logins.</li>
</ul>
<p>Sign in with Telegram uses Telegram’s newer OpenID Connect provider instead — a standard server-side redirect flow with a properly signed RS256 <code>id_token</code>. No third-party scripts on your pages, no shared bot-token secret with verifiers, automatic key rotation via JWKS. It behaves the same regardless of how privacy-locked-down the visitor’s browser is.</p>
<h3>External services</h3>
<p>This plugin connects to Telegram’s OpenID Connect provider at <code>oauth.telegram.org</code> so visitors can sign in with their Telegram account. No data is sent to Telegram unless a visitor actively starts a sign-in.</p>
<p>What is sent, and when:</p>
<ul>
<li><strong>Sign-in start.</strong> When a visitor clicks the “Sign in with Telegram” button, their browser is redirected to <code>oauth.telegram.org</code> with the bot’s Client ID, the requested scopes (always <code>openid</code> and <code>profile</code>; additionally <code>phone</code> and / or <code>telegram:bot_access</code> if you enabled those in <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Sign in with Telegram</strong>), a random <code>state</code>, a random <code>nonce</code>, and a PKCE <code>code_challenge</code> (SHA-256). The only user-specific traffic at this step is the browser redirect itself. If the discovery cache is cold (see below), building the redirect URL also triggers an anonymous server-side GET of the discovery document — no user data in that request.</li>
<li><strong>Sign-in callback.</strong> After the visitor approves the sign-in on Telegram’s side, Telegram redirects them back to your site with an authorization <code>code</code>. The plugin then makes a single server-to-server POST to Telegram’s token endpoint, sending the Client ID + Client Secret (as HTTP Basic auth), the <code>code</code>, the matching PKCE <code>code_verifier</code>, and the redirect URI. Telegram responds with a signed <code>id_token</code> containing the visitor’s Telegram identifier, name, profile picture URL, and (if the <code>phone</code> scope was granted) phone number.</li>
<li><strong>Discovery + JWKS lookup.</strong> The first sign-in after activation (and again after the local cache expires, 12 hours) triggers a one-off, anonymous GET to Telegram’s OpenID Connect discovery document and JSON Web Key Set (JWKS) at <code>oauth.telegram.org</code>. Both responses are cached in WordPress transients. If a later <code>id_token</code> references a signing key that isn’t in the cache (Telegram rotated keys), the JWKS is re-fetched once; a short cooldown prevents repeated refresh attempts. No user data is sent in any of these requests.</li>
</ul>
<p>This service is provided by Telegram. Refer to Telegram’s <a href="https://telegram.org/tos" rel="nofollow ugc">Terms of Service</a> and <a href="https://telegram.org/privacy" rel="nofollow ugc">Privacy Policy</a> for details on how Telegram handles the sign-in.</p>


Sign in with Telegram

Add Telegram login to your WordPress site. Visitors sign in with their existing Telegram account — no new password to remember.

miniOrange

<p>WordPress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any OpenID Connect provider that conforms to the OpenID Connect 1.0 standard.<br />
You can SSO to your WordPress site with any OAuth 2.0 or OpenID Connect 1.0 provider using this plugin.</p>
<h4>Description</h4>
<p>OpenID Connect Client plugin works with any OAuth/OpenIDConnect provider that conforms to the OAuth 2.0 or OpenID Connect 1.0 standard. OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. Each time you need to log in to a website using OIDC, you are redirected to your OpenID provider where you login, and then taken back to the website.</p>
<h4>Use-Cases</h4>
<ul>
<li>Login with Office365 (Office365 Login)</li>
<li>Login with Cognito (Cognito Login)</li>
<li>Login with Yahoo (Yahoo Login)</li>
<li>Login with WordPress (WordPress Login)</li>
<li>Login with Google (Google Login)</li>
<li>Login with Facebook (Facebook Login)<br />
and SSO with many more social login and mobile applications.</li>
</ul>
<p>WP OIDC / OpenID Connect client plugin enables user registration and authentication against any standard OpenID Connect (OIDC) Provider.</p>
<p>Login<br />
OIDC Client plugin enables a WordPress site to send users to an external OpenID Provider for login.</p>
<p>Registration<br />
If the user has an existing account in the OpenID Connect Provider, but not in WordPress, this plugin will enable dynamic registration of the user in WordPress.</p>
<h4>List of popular OpenID Connect Providers we support</h4>
<ul>
<li>Office 365</li>
<li>AWS Cognito</li>
<li>Amazon</li>
<li>SalesForce</li>
<li>PayPal</li>
<li>Microsoft</li>
<li>Yahoo</li>
<li>Google</li>
<li>Onelogin</li>
<li>Okta</li>
<li>ADFS</li>
<li>Gigya</li>
<li>DID.app</li>
<li>PhantAuth</li>
<li>Openidentityplatform</li>
<li>Yelp</li>
</ul>
<h4>List of popular OAuth Providers we support</h4>
<ul>
<li>WSO2</li>
<li>Eve Online</li>
<li>Slack</li>
<li>Discord</li>
<li>HR Answerlink / Support center</li>
<li>Wechat</li>
<li>Weibo</li>
<li>AWS cognito</li>
<li>Azure AD</li>
<li>Gitlab</li>
<li>Shibboleth</li>
<li>Blizzard (Formerly Battle.net)</li>
<li>servicem8</li>
<li>Meetup</li>
<li>DigitalID</li>
<li>Aerobase</li>
<li>Yandex</li>
<li>ORY Hydra</li>
<li>Odex</li>
</ul>
<h4>Other OpenID Connect/OAuth Providers we support</h4>
<ul>
<li>Keycloak, Foursquare, Harvest, Mailchimp, Bitrix24, Spotify, Vkontakte, Huddle, Reddit, Strava, Ustream, Yammer, RunKeeper, Instagram, SoundCloud, Pocket, PayPal, Pinterest, Vimeo, Nest, Heroku, DropBox, Buffer, Box, Hubic, Deezer, DeviantArt, Delicious, Dailymotion, Bitly, Mondo, Netatmo, Amazon, WHMCS, FitBit, Clever, Sqaure Connect, Windows, Dash 10, Github, Invision Comminuty, Blizzar, authlete etc.</li>
</ul>
<h4>List of grant types we support</h4>
<ul>
<li>Authorization code grant</li>
<li>Implicit grant</li>
<li>Resource owner credentials grant (Password Grant)</li>
<li>Client credentials grant</li>
<li>Refresh token grant</li>
</ul>
<h4>FREE VERSION FEATURES</h4>
<ul>
<li>WordPress OpenID Connect Client (OIDC Client) supports single sign-on / SSO with any 3rd party OAuth / OpenIDConnect server or custom OAuth / OpenIDConnect server.</li>
<li>Auto Create Users : After SSO, new user automatically gets created in WordPress</li>
<li>Account Linking : After user SSO to WordPress, if user already exists in WordPress, then his profile gets updated or it will create a new WordPress User</li>
<li>Attribute Mapping : OpenIDConnect Client supports username Attribute Mapping feature to map WordPress user profile username attribute.</li>
<li>Login Widget : Use Widgets to easily integrate the login link with your WordPress site</li>
<li>OAuth / OpenID Connect Provider Support : OpenIDConnect / OAuth Login supports only one OAuth / OpenID Connect Provider. </li>
<li>Redirect URL after Login : OpenIDConnect / OAuth Login Automatically Redirects user after successful login. </li>
<li>Logging :  If you run into issues OAuth Login can be helpful to enable debug logging</li>
</ul>
<h4>STANDARD VERSION FEATURES</h4>
<ul>
<li>All the FREE Version Features included.</li>
<li>Optionally Auto Register Users : OpenIDConnect Login does automatic user registration after login if the user is not already registered with your site</li>
<li>Basic Role Mapping :  OpenIDConnect Client provides basic Attribute Mapping feature to map WordPress user profile attributes like username, firstname, lastname, email and profile picture. Manage username & email with data provided.<br />
                      Also, Assign default role to user registering through OIDC Login based on rules you define.</li>
<li>Support for Shortcode : Use shortcode to place OIDC / OAuth login button anywhere in your Theme or Plugin</li>
<li>Customize Login Buttons / Icons / Text : Wide range of OpenIDConnect / OAuth Login Buttons/Icons and it allows you to customize Text shadow</li>
<li>Custom Redirect URL after Login : WordPress OpenIDConnect SSO provides auto redirection and this is useful if you wanted to globally protect your whole site</li>
<li>Custom Redirect URL after logout : WordPress OIDC SSO allows you to auto redirect Users to custom URL after he logs out from your WordPress site</li>
</ul>
<h4>PREMIUM VERSION FEATURES</h4>
<ul>
<li>All the STANDARD Version Features</li>
<li>Advanced Role Mapping : Assign roles to users registering through OAuth Login based on rules you define.</li>
<li>Force Authentication / Protect Complete Site : Allows user to restrict login / authorization for particular site</li>
<li>Multiple Userinfo Endpoints Support : OIDC Login supports multiple Userinfo Endpoints.</li>
<li>App domain specific Registration Restrictions : OIDC Login restricts registration on your site based on the person’s email address domain</li>
<li>Multi-site Support : OIDC Login have unique ability to support multiple sites under one account</li>
</ul>
<h4>ENTERPRISE VERSION FEATURES</h4>
<ul>
<li>All the PREMIUM Version Features</li>
<li>Multiple OAuth / OpenID Connect Provider Support</li>
<li>Single Login button for Multiple Apps : It provides single login button for multiple providers</li>
<li>Extended OIDC / OAuth API support : Extend OAuth API support to extend functionality to the existing OAuth client.</li>
<li>BuddyPress Attribute Mapping : OIDC Login allows BuddyPress Attribute Mapping.</li>
<li>Page Restriction according to roles : Limit Access to pages based on user status or roles. This WordPress OIDC Login plugin allows you to restrict access to the content of a page or post to which only certain group of users can access.</li>
<li>WP Hooks for Different Events : Provides support for different hooks for user defined functions</li>
<li>Login Reports : OIDC Login creates user login and registration reports based on application used. </li>
</ul>
<h4>REST API Authentication</h4>
<p>Secures the unauthorized access to your WordPress sites/pages using our <a href="https://wordpress.org/plugins/wp-rest-api-authentication/">WordPress REST API Authentication</a> plugin.</p>


WordPress OpenID Connect Client

Wordpress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any…

Sign in with Telegram vs WordPress OpenID Connect Client