Telegram locks down Mini Apps on July 20. Check yours before it breaks.

On July 14, Telegram shipped Bot API 10.2. Most of the changelog is the usual pleasant stuff: rich messages got better media handling, bots can now see when a user's paid subscription changes. Then, at the bottom, under 'General', one bullet with real teeth if you run a Mini App: from July 20, Mini App methods stop working from any origin except the Mini App's own domain. The protection switches on automatically, for every Mini App, whether you read the changelog or not. That's six days' notice.

A quick translation for anyone who doesn't live in this stack. A Mini App is a web app running inside Telegram, and it talks to Telegram through a narrow message bridge: open an invoice, request the user's contact, ask for biometrics, close the app. Those calls are the 'Mini App methods'. Until now, any page that found its way into your app's webview could use them. After July 20, only pages served from the domain you registered with BotFather can.

If your Mini App is one codebase on one domain, you can stop reading and go back to work. If money or logins flow through a second domain anywhere in your app, you have until Monday.

Why Telegram pulled this trigger

The hole being closed is real. When your Mini App linked to or embedded a page on another domain, that page inherited the bridge. A compromised partner page or a hijacked script could fire the same methods your own code uses, with your app's identity and your user's session behind them.

This has already happened. In 2024, a crafted open-link call through the bridge could hijack Telegram Web sessions (CVE-2024-33905, patched in the web client). The platform now moves real money through invoices, Stars and subscriptions, so an open bridge stopped being an acceptable default.

There is an opt-out, and it comes with a sentence worth reading twice. You can disable the protection through the BotFather Mini App, but in doing so 'you acknowledge that it is the responsibility of the bot to ensure that the Mini App has no links to untrusted sites.' That is a liability transfer dressed as a toggle. Use it as an emergency valve while you fix your architecture, not as a permanent setting.

Whose app breaks on Monday

The failures will cluster in flows that cross domains:

• Hosted payment pages. The user pays on your provider's domain, and that page calls a method to close the webview or signal success. From July 20 that call is ignored, and your user is stranded on a receipt page wondering whether anything happened.
• Third-party login. OAuth flows that finish on the provider's domain and then reach for the bridge to hand control back to the app.
• Multi-domain products. A marketing domain and an app domain, or per-region domains, where the secondary one still calls the SDK.
• Widgets and white-label setups. Anything SDK-flavored served from a vendor's CDN rather than your own origin.
• Preview and staging builds. Deploy previews on platform-generated URLs are separate origins too. Your production app may be fine while QA quietly stops working, or the other way round.

The failure mode is the nasty kind: silent. Nothing throws, nothing crashes. The call just doesn't happen. A checkout that has worked for a year ends at a button that does nothing, and your support inbox is how you find out.

The audit, in an afternoon

1. List every origin that touches the bridge. Grep the codebase for the SDK import and for direct postMessage calls, then walk each user flow and write down every domain it passes through.
2. Stare hardest at payments and auth. Any step where the user leaves your domain and something is supposed to happen when they come back is a candidate.
3. Bring the calls home. The clean fix is a thin return page on your registered domain: the third-party page redirects there, and that page makes the bridge call. Most teams can ship this in a day.
4. Test in real clients. iOS, Android and desktop webviews don't behave identically, and this is not the week to trust the docs over the device.
5. If you can't make Monday, opt out, fix, opt back in. Leaving the protection off permanently means owning every page your app can ever reach.

The bigger signal

Zoom out and this is the third platform this year to tighten the rules on builders mid-flight. Apple started pulling AI-generated apps that fail its quality bar. Shopify switched off Scripts on June 30 and broke checkout logic for stores that hadn't migrated. Now Telegram, with the shortest notice of the three.

None of these are hostile moves. They are what platforms do once real money and real users arrive: the defaults harden and the grace periods shrink. Mini Apps crossed that line a while ago. Half a billion people have used one, payments are native, and Bot API releases now land monthly. Rich Messages in June, subscription events and this lockdown in July.

The lesson for anyone building on rented land isn't to stop building there. The reach is why you came. The lesson is architectural: keep your app on one origin, keep other people's pages away from the bridge, and treat every external domain in a user flow as a dependency that can be revoked with a changelog bullet. Teams that build that way read announcements like this one with coffee, not with a war room.

Telegram's Mini App bet is still one of the better asymmetries in consumer software: a billion users, no app store review, a build cost most founders can afford. The platform just stopped being casual about security, and it won't be the last tightening. If your app crosses domains, you have the weekend.