Telegram linking and subscription sync

Signed authentication

Mini App init data is validated with the Telegram bot token according to Telegram’s signed data algorithm. Login Widget payloads use their corresponding verification algorithm and an allowed authentication age.

VIP is the source of truth

The existing bot stores its VIP map in the SwiftToolBot_EventHandler_vipUsers table as igbinary values. SwiftTool Web does not parse those bytes heuristically. A local PHP compatibility bridge decodes them with the same extension used by the bot and returns a normalized, minimal snapshot.

The web database stores a subscription snapshot for display and audit. It does not replace the bot record as the authoritative source.

Plan resolution

An active, unexpired record can resolve to Pro, Expert or Ultra. A missing record, Free record, expired record or failed bridge request resolves to Free. This fail-closed behavior prevents an accidental paid upgrade.