Authentication & connections
Sign in with your existing Telemetrio account. Three independent credentials have different purposes:
| Credential | Purpose | Storage |
|---|---|---|
| Official Telegram Ads API token | Access the provider root and its related accounts | Encrypted in the Ads connection service; transferred only after explicit confirmation |
| Extension session | Manage your own saved connections | Trusted local extension storage; revocable and expires after 30 days |
| AI-client authorization | Use only selected accounts and approved read/advertising/budget rights | Scoped grant managed by Telemetrio; provider token never reaches the AI client |
Your Telemetrio analytics API key does not grant Ads access. The extension signs in through Telemetrio with PKCE and an exact registered callback. An authorization code can be used once and expires after 60 seconds.
Connection lifecycle
Each official connection identifies one provider root and can discover related accounts for explicit per-account consent. Creating or replacing a connection verifies the provider token with Telegram before saving it. Replacement must match the original account; a different Ads account needs a separate connection.
Metadata contains status, safe account names and the last successful check time. An active status records the last successful read or check; use Check for a fresh verification. A provider outage leaves the saved connection intact. An expired key requires Update key. A failed replacement preserves the previous credential.
Credential replacement and disconnect require the current connection version. A stale version returns CONNECTION_VERSION_CONFLICT; refresh the connection and retry the intended action. Disconnect deletes the locally saved provider token and blocks access through every AI grant for that connection. It does not revoke Telegram's token.
Legacy cookie connections show migration_required. They cannot make provider reads until you explicitly transfer an official API token. Cookies are not migrated or used as fallback.
Separate AI access
Connecting Telegram Ads does not connect an AI client. On the Ads-specific consent screen, select exact root/related accounts and their Read-only, Manage advertising and Manage budgets permissions. Connections added later are excluded. Revoking one AI authorization leaves the advertising connection and other AI authorizations intact.
Public browser requests use an extension session. Internal bridge credentials and scoped tgam_ grants remain server-side; they are never returned by GraphQL to the browser. Keep all credentials out of URLs, logs, analytics and screenshots. Logging out of the extension revokes its device session and leaves saved connections intact.