Telethon first steps in python

Question

All right, so I've been intending to use Telethon to automate several things on telegram with Python, but I'm not sure I understand the gist of it.

First of all, you need an api_id and an api_hash. To do so, you go to my.telegram and go to API development tools. There you are sent a code to your telegram android phone and after submitting, you receive an unique id/hash. First question, is this code you are sent in order to generate an app necessary any more?

Now in python, you can start a client as follows.

from telethon import TelegramClient

api_id=12345
api_hash='abcdef12345ghij'

client=TelegramClient('name of the session',api_id,api_hash)

You can try to connect the client, but it can lead to it not being authorized or the phone not being signed up, so you can use start, which will decide between sign in, or sign up. Among the parameters you can set in start, there is force_sms (bool, optional) to force telegram to share the code needed to register and log in by sms. My question here are, if the phone is not signed up, what other means could have telegram used? I mean, they can't send it to the mobile app as that phone doesn't have one.

If a phone not being signed up is a possibility, does this mean the phone with which you got your id/hash is is not necessarily the same with which you create the client?

As this method has a callback, you can input the code sent to your phone and connect to telegram.

Another way to connect a client is using StringSession. I found this piece of code:

from telethon.sync import TelegramClient
from telethon.sessions import StringSession

# Generating a new one
with TelegramClient(StringSession(), api_id, api_hash) as client:
    print(client.session.save())

# Converting SQLite (or any) to StringSession
with TelegramClient(name, api_id, api_hash) as client:
    print(StringSession.save(client.session))

# Usage
string = '1aaNk8EX-YRfwoRsebUkugFvht6DUPi_Q25UOCzOAqzc...'
with TelegramClient(StringSession(string), api_id, api_hash) as client:
    client.loop.run_until_complete(client.send_message('me', 'Hi'))

This bring several questions on its own. According to the docs, this is a way to storing in a string the credentials needed to login, including the authorization key and the phone.

How is this obtaining the authorization key? In the other method, it was sent to your phone for you to input, but here? How can you specify the phone to which you want to connect? Is this a method you can only, or you should only use after the phone has been given access?

In code, is this a possibility?

#Obtain an api_id, api_hash from phone 777777777

from telethon import TelegramClient
from telethon.sessions import StringSession

api_id=12345
api_hash='abcdef12345ghij'    
client=TelegramClient('name of the session',api_id,api_hash)

client.start(phone='5555555',force_sms=True,code_callback=True,first_name='John',last_name='Doe')
#Asked to input the code sent to the phone 555555 by sms. Is this code the authentication key?

string = StringSession.save(client.session) #Now I can connect whenever I want using string session.

Two last questions

Can you have more than one session for the same number, even if they don't try to connect at the same time? Like for example, with different api/hash starting the same phone at different times, or as the first session is stored within telegram, creating the second severes the link to telegram of the first?

Can you skip in any way the verification code using for signing up?

Kind regards

Answer 1

is this code you are sent in order to generate an app necessary any more?

Yes, like with many online services offering an API, you register your developer account and get a token (in Telegram's case, api_id and api_hash combination) that can be used to access the API (at all or with less limitations).

It might seem a bit confusing that your application is bound to your user account, however this doesn't mean it can only be used in your account. You, the developer, create an application, and any other user (or even bot) can run your application using your api_id and api_hash.

As an example, when you use Telegram for Android or Telegram Desktop, you are running the application they developed, and are logging in using the api_id and api_hash of the respective developers, not your own.

if the phone is not signed up, what other means could have telegram used?

Telegram may send a SMS to the phone number or perform a phone call. You can use https://tl.telethon.dev to find that send code returns, at the time of writing, a SentCode. This comes with a SentCodeType which currently can indicate: sent via app, call, flash call, or SMS.

does this mean the phone with which you got your id/hash is is not necessarily the same with which you create the client?

As explained above, the api_id and api_hash is for the developer of the application, not the users that will login to your application. When you get started, this person is often the same (you, the developer), but when you publish your application, anyone can sign in without needing to provide their api_id and api_hash. Of course, you would need to keep those secret to try to minimize people from using your key in their applications, although this is not really doable.

How is this obtaining the authorization key?

StringSession embeds the authorization key that was generated to be used for encryption inside the string itself. Next time you use the client, all you need is this key, as Telegram already knows who you are with it, because you signed in before.

How can you specify the phone to which you want to connect?

There is no need. Telegram remembers the account that logged in with a certain authorization key. In official clients, you may see which devices are logged in and terminate their sessions (invalidating their authorization key) to log them out.

Is this a method you can only, or you should only use after the phone has been given access?

You can use StringSession to login, too, and just print it and reuse it later. In this case, the StringSession would begin empty, Telethon would generate an authorization key, you would login, and saving the session would produce something that can be reused.

Can you have more than one session for the same number, even if they don't try to connect at the same time?

Yes, this is what happens when you use, for example, Telegram for Android and Telegram Desktop. Adding a third with Telethon is not different.

Can you skip in any way the verification code using for signing up?

No, because Telegram needs to validate the phone exists and is in use.