> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bondify.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# What is Bondify?

> Bondify is a messenger authentication platform. Add passwordless sign-in to any web or mobile app in minutes — no SMS, no OAuth, no passwords.

Bondify lets your users sign in with the **messenger they already use** — Telegram today, with WhatsApp and Discord on the way. One tap in the messenger and they're in. No passwords to remember, no SMS codes to wait for, no third-party OAuth consent screens.

You integrate once. Bondify handles the rest: the bot interaction, the session lifecycle, the cryptographic proof, and delivery to your backend.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart/quickstart">
    Go from zero to a working Telegram sign-in in about five minutes.
  </Card>

  <Card title="How it works" icon="diagram-project" href="/introduction/architecture">
    The stateless, JWT-based proof model in technical detail.
  </Card>

  <Card title="React & Next.js" icon="react" href="/guides/react/react">
    Drop-in <code>@bondify/react</code> provider, button, and hooks.
  </Card>

  <Card title="Backend verification" icon="shield-check" href="/guides/backend-verification/backend-verification">
    Verify the proof on your server before trusting any login.
  </Card>
</CardGroup>

## Why Bondify?

Most auth solutions were built around email and passwords, then bolted on social logins as an afterthought. Bondify is built from scratch for messenger-native audiences — communities, mini-apps, SaaS products, and tools where your users already live in their messenger.

|                             | Bondify      | Email / password    | Telegram Login Widget |
| --------------------------- | ------------ | ------------------- | --------------------- |
| Setup time                  | \~5 min      | Hours               | \~30 min              |
| User friction               | One tap      | Form + email verify | QR scan or phone      |
| Password management         | None         | Required            | None                  |
| Works in Telegram Mini Apps | Yes          | No                  | Limited               |
| Webhook support             | Yes          | Depends             | No                    |
| Free tier                   | 1,000 MAU/mo | Varies              | Free (self-hosted)    |

## How it works

<Steps>
  <Step title="The user starts sign-in">
    Your app calls Bondify, which creates a `pending` session and opens Telegram with a deep link.
  </Step>

  <Step title="The bot asks for confirmation">
    The Bondify bot (or your own white-label bot) sends the user a confirmation prompt in Telegram.
  </Step>

  <Step title="The user taps Confirm">
    One tap — no typing. The session becomes `confirmed`.
  </Step>

  <Step title="Bondify issues a signed proof">
    Bondify mints a short-lived **proof** — a JSON Web Token signed with your project's webhook secret — that carries the user's Telegram identity.
  </Step>

  <Step title="Your server verifies the proof">
    Your backend verifies the proof locally (no round-trip to Bondify) and creates its own session — a cookie, JWT, or DB record, exactly as it already does.
  </Step>
</Steps>

The whole flow, from tap to confirmed, typically takes **3–5 seconds**. If you prefer push over polling, configure a [webhook](/guides/webhooks/webhooks) and Bondify will POST the confirmed identity to you directly.

## Core concepts

### Project

A project is one integration — one app or environment. Each project carries three identifiers:

<ParamField path="project_id" type="string (proj_…)">
  Public. Identifies your project in the browser, mobile SDK, and deep links. Safe to ship in client code.
</ParamField>

<ParamField path="secret_key" type="string (sk_…)">
  Server-only. Authenticates server-to-server `/generate` and `/verify` calls. Never expose it in client code.
</ParamField>

<ParamField path="webhook_secret" type="string (whsec_…)">
  Server-only. Verifies the **proof JWT** and **webhook signatures**. This is the value `@bondify/node` needs. Shown under **Project → Settings → Webhook Secret**.
</ParamField>

<Warning>
  `secret_key` and `webhook_secret` are two different server-side keys. Use `secret_key` to *create* sessions and `webhook_secret` to *verify* proofs and webhooks. Mixing them up produces an `invalid signature` error — see [Backend verification](/guides/backend-verification/backend-verification).
</Warning>

You can create unlimited projects on the Pro and Business plans (Hobby is limited to one).

### Session

A session is created the moment a user starts sign-in. It moves through a defined lifecycle:

| Status      | Meaning                                                         |
| ----------- | --------------------------------------------------------------- |
| `pending`   | Waiting for the user to tap Confirm in Telegram                 |
| `confirmed` | User confirmed — the proof is ready                             |
| `expired`   | The 10-minute TTL elapsed without confirmation                  |
| `cancelled` | User tapped Cancel in Telegram                                  |
| `used`      | The proof was read once via `/verify` — the session is consumed |

### Proof

When a session is confirmed, Bondify produces a **proof**: a JWT (HS256) signed with your project's `webhook_secret` and valid for **5 minutes**. Your server verifies it locally with that same secret — there is no verify-time round-trip to Bondify. See [How it works](/introduction/architecture) for the exact payload.

### Channel

The messenger used for authentication. **Telegram is live today**; WhatsApp and Discord are on the way. The SDK surface and the proof model stay the same across channels.

## Plans

Billing is based on **MAU** — monthly active users, counted as unique Telegram accounts that confirm a sign-in, summed across all of your projects.

|                              | Hobby                    | Pro                       | Business                  |
| ---------------------------- | ------------------------ | ------------------------- | ------------------------- |
| Price                        | Free                     | $20/mo ($16/mo annual)    | $60/mo ($48/mo annual)    |
| MAU included                 | 1,000                    | 10,000                    | 50,000                    |
| Over-limit MAU               | —                        | \$0.02 / MAU from balance | \$0.02 / MAU from balance |
| Projects                     | 1                        | Unlimited                 | Unlimited                 |
| Bot                          | Shared Bondify bot       | Your own (white-label)    | Your own (white-label)    |
| Phone collection             | —                        | Yes                       | Yes                       |
| IP allowlist                 | —                        | Yes                       | Yes                       |
| Webhooks                     | Persistent queue + retry | Priority + delivery logs  | Guaranteed delivery       |
| Organizations & roles (RBAC) | —                        | —                         | Yes                       |
| Audit log export             | —                        | —                         | Yes                       |
| Log retention                | 1 day                    | 14 days                   | 90 days                   |
| Support                      | Community                | Community                 | Priority                  |

<Note>
  New accounts start on a **7-day free trial of Pro**. When the trial ends, the account automatically moves to Hobby unless you subscribe. Over-limit MAU are billed at **\$0.02 each** from a prepaid balance you top up — there are no automatic card charges for overage.
</Note>

## SDKs

Bondify ships official packages for the most common stacks. Pick the one that matches your app:

<CardGroup cols={3}>
  <Card title="@bondify/react" icon="react" href="/guides/react/react">
    React 18/19, Next.js 14–16. Provider, button, modal, QR, and hooks.
  </Card>

  <Card title="@bondify/node" icon="node-js" href="/guides/backend-verification/backend-verification">
    Express/Node. Proof verification, middleware, and webhook handlers.
  </Card>

  <Card title="bondify_flutter" icon="flutter" href="/guides/flutter/flutter">
    Flutter / Dart client for mobile apps.
  </Card>
</CardGroup>

No framework? Call the public REST endpoints directly — see [HTML & Vanilla JS](/guides/vanilla-js/vanilla-js).