Why you get logged out: session errors
Every Telegram login is a separate session with its own key. When a session stops being valid, the app throws you back to the login screen, and tools get one of the errors from the official list:
| Error | What happened |
|---|---|
| SESSION_REVOKED | the session was terminated — for example, with "terminate all other sessions" |
| AUTH_KEY_UNREGISTERED | the session key is no longer registered on the server |
| SESSION_EXPIRED | the authorization has expired |
| AUTH_KEY_DUPLICATED | one session was used from two places at once |
| USER_DEACTIVATED | the account was deleted or deactivated |
The first four mean the session is gone, not that you're banned: you can log in again with your number. The last one means the account no longer exists. If the account works but can't message strangers, that's something else — see the guide on spam blocks.
One session in two places
The most common cause for people who work with session files. If the same key connects from two places at once — two tools, two servers, a tool and a copy on another computer — the server responds with AUTH_KEY_DUPLICATED and revokes the session. After that you need a fresh login with your number.
The rule is simple: one session, one place. Need access from a second place? Log in there separately — that becomes its own session. More on session files in the guide on tdata and .session.
The 24-hour rule
A session less than a day old can't terminate the account's other sessions. The server returns FRESH_RESET_AUTHORISATION_FORBIDDEN, and the app asks you to wait. This protects the owner: if someone gets your code and logs in, they can't immediately kick out the real owner.
In practice: if you just logged in on a new device, you'll only be able to end older sessions after a day. Changing the cloud password from such a session is usually refused too.
Login from a new device
When someone logs in from a new device, your other sessions get a notification asking "was this you?". Answering "no" ends the new session immediately. If nobody answers, the session confirms itself after a few days — the example config in the documentation uses 7 days.
If you don't recognize a login, answer "no" and change your cloud password.
Deletion of inactive accounts
Telegram deletes accounts nobody has logged into for a long time. The default is 18 months; in privacy settings you can change it to 1, 3, 6, 12, 18 or 24 months.
Separately, you can have inactive sessions end automatically — from a week to a year. If an account is only open in a tool that connects rarely, make sure these terms won't catch you out.
"Your account will be blocked" messages
Telegram sends login codes only to the service chat named "Telegram" with a blue checkmark. The code must never be shared — if it's forwarded to another chat, the server invalidates it on its own.
So any message like "your account will be blocked, confirm the code" or "follow this link to avoid deletion" — from an unknown account, a bot or an outside site — is almost certainly a scam. Real restrictions are shown in the app itself and through @SpamBot; Telegram doesn't ask you to send it a code.
How to see and end active sessions
All logins are listed under "Settings → Devices" (on some platforms, "Privacy and Security → Active Sessions"). You'll see the device, app, country and last activity time, plus a "Terminate all other sessions" button.
What a cloud password protects, and what it doesn't
The cloud password (two-step verification) is asked at login: once it's set, a new login needs both the code and the password. That protects you well against someone who learned your code.
But the password is only checked at login. If someone already has a working session — say, a copied session file or tdata folder — they don't need the password. The only defense then is to end that session in your device list.