telegramId and telegramUsername not updating in DB after successful Telegram link

[iatomic1]

Hey, I’m having an issue with the Telegram plugin.

After linking a Telegram account, the link process completes successfully, but the telegramId and telegramUsername fields aren’t being updated in the database.

Here’s my setup:

"better-auth": "^1.3.1",
"better-auth-telegram": "^0.3.1"

And my plugin configuration is pretty basic:

telegram({
botToken: process.env.TELEGRAM_BOT_TOKEN!,
botUsername: "username",
});

The Telegram linking flow works fine (the success message shows up), but the user record in the DB stays unchanged.
Is there something I’m missing in the configuration, or should this update happen manually?

[iatomic1]

UPDATE: After logging this
const linkRes = await authClient.linkTelegram(authData);

I get this res
{
data: { error: "Not authenticated"
error: null
}

Tho on the telegram app, it showed the bot on the "Connected Devices" tab

[vcode-sh]

Hey @iatomic1, thanks for reporting this!

You're hitting a classic cookie authentication issue. The "Not authenticated" error means your session cookies aren't making it to the server when you call linkTelegram().

The Fix

Update your auth client config to include credentials:

export const authClient = createAuthClient({
  baseURL: typeof window !== 'undefined'
    ? window.location.origin
    : process.env.NEXT_PUBLIC_APP_URL,
  fetchOptions: {
    credentials: "include",  // 👈 Add this
  },
  plugins: [telegramClient()],
});

Without credentials: "include", your browser won't send cookies with the request. No cookies = no session = "Not authenticated" error.

Why This Happens

The Telegram bot showing up in "Connected Devices" just means the Telegram authentication succeeded. But when your app tries to link that Telegram account to your existing user, it needs to know who you are. That's where the session cookie comes in.

The flow is:

1. You sign in to your app (session cookie set)
2. You click the Telegram link button
3. Telegram authenticates you (works fine)
4. Your app calls linkTelegram() to connect the accounts
5. Without credentials: "include", the session cookie doesn't get sent
6. Server checks for authentication, finds nothing
7. Returns "Not authenticated"

Double Check

Also make sure your baseURL is correct. If you're using a different domain or port, cookies won't work:

// ✅ Good
baseURL: window.location.origin

// ❌ Bad (different domain)
baseURL: "http://localhost:4000"  // when your app is on :3000

This should fix it. Let me know if you're still stuck.

---

Side note: I'm updating the docs and examples to make this more obvious. It's in the troubleshooting guide, but clearly not prominent enough if you hit this issue. Good catch.

[iatomic1]

fetchOptions: {
credentials: "include", // 👈 Add this
},

Hey still not working 🥲
Do i need to first call authClient.signInWithTelegram b4 being able to use the linkTelegram method?

The user is signed in through google atm and i just want them to link their tg acct
Also I'm not using diff ports

[vcode-sh]

Hey @iatomic1, let's debug this step by step.

No, you don't need to call signInWithTelegram first - linking should work with any auth provider (Google, email, etc.). The session from Google OAuth should work fine.

Debug Steps

1. Verify You're Actually Logged In

First, let's confirm your session exists. Add this to your component where you're trying to link:

useEffect(() => {
  // Check session
  authClient.getSession().then((session) => {
    console.log("Current session:", session);
  });
}, []);

What to look for:

• If session.data?.user exists → you're logged in ✅
• If it's null or undefined → you're NOT logged in ❌

2. Check Network Request

Open DevTools → Network tab, then try linking. Look for the request to /api/auth/telegram/link (or whatever your auth endpoint is).

Check these:

1. Request Headers - should include:

   Cookie: better-auth.session_token=...
   

   If there's NO Cookie header, credentials aren't being sent.

2. Response - what's the actual error?

   { "error": "Not authenticated" }

3. Verify Your Setup

Share your full client config (sanitize any secrets):

// Your auth-client.ts
export const authClient = createAuthClient({
  baseURL: ???,  // What's this value?
  fetchOptions: {
    credentials: "include",
  },
  plugins: [telegramClient()],
});

Common issues:

❌ Wrong baseURL:

// If your app runs on http://localhost:3000
// but you set:
baseURL: "http://localhost:3001"  // WRONG - different port

❌ Not using window.location.origin:

// Better:
baseURL: typeof window !== 'undefined'
  ? window.location.origin
  : process.env.NEXT_PUBLIC_APP_URL

4. Check Cookie in DevTools

DevTools → Application → Cookies → your domain

Look for: better-auth.session_token (or similar)

Check:

• Does it exist?
• What's the Domain?
• What's the Path? (should be /)
• Is SameSite set correctly?
• If using HTTPS, is Secure flag set?

5. Framework-Specific Issues

Next.js App Router - make sure you're not accidentally running this on the server:

"use client";  // 👈 Must be at the top

import { authClient } from "./auth-client";

Middleware - if you have Next.js middleware, it might be interfering with cookies.

What I Need From You

To help debug, please share:

1. Console output from the session check (step 1)
2. Screenshot of the Network request (step 2) - especially headers
3. Your auth client config (step 3)
4. Cookie details from DevTools (step 4)
5. What framework/setup you're using (Next.js App/Pages router, plain React, etc.)

Also:

• Are you using a custom domain or localhost?
• Are you behind a proxy/ngrok?
• Is your app on HTTPS or HTTP?

Once I see these details, I can pinpoint exactly what's wrong.

[iatomic1]

Hey @vcode-sh

1. Yup I'm logged in
2. Cookies are being passed

3. auth-client.ts

export const authClient = createAuthClient({
	trustedOrigins: [NGROK_PERSONAL_DOMAIN],
	baseURL: typeof window !== 'undefined'
  ? window.location.origin : NGROK_PERSONAL_DOMAIN,
	fetchOptions: {
		credentials: "include",
	},
	plugins: [
		twoFactorClient(),
		emailOTPClient(),
		telegramClient(),
	],
});

• Yes it exists
• NGROK_PERSONAL_DOMAIN
• path is /
• sameSite - Lax
• httpOnly - true
• Secure - true

5. Nextjs App Router

[iatomic1]

The req says 200 tho

[iatomic1]

After cloning locally, I've determined it returns here, haven't been able to figure out the prob tho
What's also weird is that the req is returning 200 instead of 401

					if (!session?.user?.id) {
						console.log("STEP 3.1: Not authenticated");
						return ctx.json({ error: "Not authenticated" }, { status: 401 });
					}

[iatomic1]

ig no more replies

[vcode-sh]

@iatomic1 Good news - you found a real bug!

The Problem

You were right to clone the plugin and add console.logs. The issue is that ctx.context.session was null even though cookies were being sent correctly.

Turns out I forgot to add sessionMiddleware to the endpoints. Better Auth needs this middleware explicitly declared to populate ctx.context.session.

The Fix

I just pushed a fix. I was missing this in the endpoint config:

linkTelegram: createAuthEndpoint(
  "/telegram/link",
  {
    method: "POST",
    use: [sessionMiddleware],  // 👈 This was missing!
  },
  async (ctx) => {
    const session = ctx.context.session;  // Now this will actually exist

Without it, Better Auth doesn't know the endpoint needs session data, so it doesn't populate ctx.context.session - even when cookies are sent.

What You Need To Do

Update to the latest version once I publish it (should be out shortly as v0.3.2):

npm install better-auth-telegram@latest

Then it should just work. Your config with credentials: "include" was actually correct all along.

Why This Happened

This is 100% on me. I missed this requirement in the Better Auth docs when building the plugin. Thanks for debugging this so thoroughly - the screenshots and local testing really helped nail it down.

Let me know if it works after updating!

[iatomic1]

Hey @vcode-sh it worked
tho, dunno if its a bug on my end but i had to add these fields to the adapter creating the account

							createdAt: new Date(),
							updatedAt: new Date(),

without it the account creation would throw an err

[vcode-sh]

@iatomic1 — late reply on the createdAt / updatedAt thing. Sorry about that.

That's a Better Auth adapter quirk, not this plugin. Some adapters (looking at you, Prisma) require those timestamps explicitly when creating records, while others auto-generate them. The plugin delegates account creation to Better Auth's internal adapter — if your adapter demands those fields and Better Auth doesn't pass them, it blows up.

Workaround: make createdAt / updatedAt default to now() at the database level (Prisma's @default(now()), Drizzle's .default(sql\now()`), raw SQL's DEFAULT CURRENT_TIMESTAMP`). That way the adapter doesn't need to pass them at all.

Glad the main fix worked though. Cheers for the thorough debugging on this one — genuinely helped ship a better patch.