Two-Step Verification and API Sessions on an Account You Did Not Create
Taking over a Telegram account, one protective step works in the first minute and the other is blocked for a day. Which is which is the opposite of what most handover checklists say, and Telegram documents the reason in its own interface reference.
Sarah Johnson
You have been handed a Telegram account for a team. Old devices are signed in somewhere, nobody told you the password, and a script needs access on top of that. The standard advice is to clear the devices first and set a password after.
Do it in that order and the first step fails. Telegram will not let a session log out any other session until it has itself been signed in for 24 hours, and it says so in the error. The password change has no such restriction. So the sequence everyone repeats is backwards, and this page carried the backwards version until now.
"API login" means three different things
Worth settling first, because the English phrase collides and half the people searching it want something else entirely. Of the search suggestions on "telegram api login", five are about bots and another is the Login Widget.
- A bot. A separate identity with a token from BotFather. It is not an account, it cannot be bought as one, and nothing on this page applies to it.
- The Login Widget. The "Log in with Telegram" button on somebody else's website. It signs you into that site. It has nothing to do with controlling an account.
- A user session created through the API. A script acting as an actual account, using an API id and hash plus a stored authorisation. This is the one that matters when an account changes hands, and it is the one meant when a listing mentions an API login link.
On our own shelf that third meaning is rarer than its prominence suggests: the word appears in only a small minority of live Telegram listings. Most of this shelf hands over files rather than a login link.
What a session record actually contains
Every authorisation on the account, whether it came from a phone, a desktop client or a script, is one entry with the same fields. Telegram documents them, and reading the real list is more useful than any summary table.
Each entry carries the device model, the platform, the system version, the app name and version, the API id it was created under, when it was created, when it was last active, and the last known address with a country and a region. Two flags are worth knowing about because they explain things people find confusing:
- The country and region are derived from the address, not from the device. Telegram's own field descriptions say both are determined from the IP. An unexpected city is usually a routing artefact rather than evidence.
- A session can be waiting for the password. There is a flag meaning the session has not yet supplied the two-step password. Somebody can be one step into your account, holding a valid code and stopped at the second door, and that state is visible.
The API id field is the practical one for automation. It tells you which entry belongs to which script, which matters when you are about to end sessions and do not want to sever your own tooling.
The one lock you can turn in the first hour
Changing the two-step password works immediately. There is no waiting period on it, and it is the only protective action available on day one.
What it does not do is evict anybody. A session already running is unaffected, and no amount of password changing will remove it. What it does is close the door through which another session could be added: after the change, a new sign-in with the phone number is asked for a password only you know.
That distinction is the whole point. The password change does not clean the account. It stops the account getting dirtier while you wait for the ability to clean it.
On format, one correction to what this page used to say: Telegram publishes no minimum length for this password and no requirement to mix character classes. Any such rule you read, including the one that used to be on this page, is invented. Choose something long because that is sensible, not because a rule exists.
Why the device list has to wait a day
The restriction covers more than the obvious button. Ending a single device, ending all other devices, and setting the session time-to-live are all refused with the same error for the same 24 hours. That last one closes the workaround of asking Telegram to expire the old sessions for you.
The reason is defensible once you invert it. If a fresh session could terminate everything else, anyone who signed in with an intercepted code could lock the real owner out of their own account in the same minute. The lock costs an attacker a day, and in that day the genuine owner can act, because their session is old enough to be allowed to.
Applied to a handover, that protection is pointing at you. For the first 24 hours the previous holder can end your session and you cannot end theirs.
There is one exception, and it runs the other way. When a new session signs in, the sessions already present are notified and can reject it. If you still control an older session on the account, that is the path that ends a new login immediately, because the instruction comes from an old session rather than a new one. Left unanswered, an unrecognised login confirms itself after seven days.
The recovery address decides who owns the account
More important than the password, and routinely skipped. A recovery address pointing at a mailbox you cannot read means the account is not durably yours, whatever password you set on it, because the address is the route back in.
Check what is set before you change anything, then set your own. If the account arrives with a recovery address you cannot inspect and the seller cannot remove, that is the finding, and it is worth raising while the warranty window is open. On most Telegram listings here that window is measured in hours, so this check has to happen early or not at all.
If registration or recovery routes through a phone number you do not fully control, a dedicated SMS verification number keeps that step separate from your personal line.
The seven-day clock, and what actually starts it
If the password is lost and no recovery address is set, the route back is a reset rather than a recovery, and Telegram runs a seven-day server-side timer before it completes. During those seven days anyone holding a working session can cancel it, which is the point of the delay: it gives a real owner a week to stop a stranger from resetting their password.
Read from the buying side, that cuts both ways. A reset you start can be cancelled by whoever else is still signed in. Another reason the device list matters more than the password does.
Automation, without cutting your own line
A script's authorisation is an entry in the same list as your phone, so ending sessions ends scripts. If a bot or tool depends on a session you are about to clear, create the replacement under your own API credentials first, confirm it is working, and only then remove the old one.
The general shape holds: keep automation on its own account rather than on one a person also uses. Not because Telegram publishes a rule about it, but because when you have to clear a device list in a hurry you want the blast radius to be one thing.
Whatever you inherited, treat the password that came with it as the seller's password until you have replaced it. On this shelf a two-step password is already set on well over half of the live Telegram accounts listed, and it costs nothing extra, which tells you what it is: not a feature somebody added for you, but a credential somebody else chose. Telegram's FAQ covers where the settings live, though not the 24-hour rule, which appears only in its interface documentation.
Frequently Asked Questions
No, and the English phrase collides three ways. A bot is a separate identity with its own token and is not an account. The Login Widget is a sign-in button for other websites. An API session is a script acting as a real account using an API id and hash plus a stored authorisation, and only that third one is relevant when an account changes hands.
No. An authorisation that already exists keeps working, and changing the password does not touch it. The password is checked when a new session is created, not on every request from an old one. Removing a running script means ending its session, which is a different action and one you cannot perform in the first 24 hours.
Telegram refuses to let a session log out any other session until it has been signed in for a full day, and returns an error saying exactly that. The same block applies to ending all other devices and to setting the session expiry, so there is no indirect route. Change the password on day one and clear the list on day two.
None that Telegram publishes. There is no stated minimum length and no requirement to mix letters, numbers and symbols, and any specific rule you find quoted is somebody’s invention rather than a documented constraint. Length is still worth choosing well, just not because a rule compels it.
Generate the replacement under your own API credentials and confirm it works before ending anything. Each session entry records the API id it was created under, so you can identify which belongs to your tooling. Ending sessions ends scripts, and doing it in the wrong order costs you access to your own automation.
Not yet. Two things still stand between you and control: sessions already signed in, which you cannot remove for a day, and the recovery address, which is the route back into the account for whoever it points at. Check the recovery address before anything else, because a password you control on an account whose recovery mailbox you do not is not ownership.
Yes. A reset runs a seven-day server-side timer, and anyone holding a working session on the account can abort it during that week. That delay exists to protect real owners from strangers, so on an account where you are not sure who else is still signed in, the reset route is not reliable until the device list is clear.
Sarah Johnson
Digital marketing expert with 10+ years of experience in social media strategy. Passionate about helping businesses grow their online presence through effective marketing techniques.
