Sign in with VISH

Other sites and applications may offer the “Sign In via VISH” button. Then you log in with your VISH account — via Telegram or MAX, as in the application itself — and do not enter a new password there. The app gets only what you have allowed, and nothing beyond that.

How does the entrance work?

1. On someone else's site, you click “Log in at VISH”, and page VISH opens. “Log in at VISH”.
2. If you haven't logged in to VISH yet, the page will ask you to log in via Telegram or MAX and after logging in, it will return you to the query.
3. The page shows who is requesting access: The “"name" requests access to your account VISH”, the website of the application and its developer, and below is the list the “Application will receive:”. At the bottom, which account are you logged in to and the link is “Not you? Exit”.
4. “Allow” returns you to the app, and you are already logged in. “Reject” returns you there too, but the app doesn't receive anything.

If you have already allowed the application everything it asks for, the next time you log in, the page will immediately bring you back without asking again.

What the app can ask for:

• To recognize you at the entrance is your number for this application. The app doesn't receive your Telegram, MAX, and phone number, and two different apps can't match that it's the same person.
• First name and photo — first name, last name, profile photo and interface language.
• Your group is the study group that you belong to.
• Your role is a student, teacher, or employee.
• Read your schedule — pairs, audiences, and changes, view only.
• Read notes for couples — notes for classes, view only.

The application cannot write on your behalf, change something to VISH, or read other people's data, no matter what permission it receives. Employee or administrator rights, if you have them, are also not transferred to the application.

They allow everything that the application asks for at once, or they refuse: you can't select some of the permissions yet.

Connected Apps

All applications that you have allowed to log in are collected in “Settings” → “Access” → “Connected applications” (after logging in; address /settings/access/apps). Each one has a name, a website, when you connected it, and when you last logged in.

“Disabling” it immediately disables the app from accessing your account: it stops receiving your data from the next request. To use it again, you need to log in again through VISH and allow access. If you delete account VISH, all connections are deleted along with it.

If something went wrong

• “This login request cannot be executed”. The link you came from is incorrect, or the app has been stopped. VISH in this case does not redirect you anywhere, so that the link cannot lead you to a fake site. Go back to the app from where you came from and start logging in again. If it repeats, write it to the developer.
• “Entry via VISH is currently disabled”. On this server, VISH login for other applications does not work.
• “Open the login in a separate window”. VISH does not show an access request inside another site so that it cannot be substituted or clicked for you. Click “Open in a new window”.

Allow access only to applications that you have opened yourself and that you trust.

For developers

The “owner of a valid API key can connect Login via VISH” to his website or application. How to get it is written on the “API and access keys” page. Applications are registered on the “developer” page (address /developers), in the “Log in through VISH section — your applications”; without a key, instead of the “Register application” button, you “need a valid API key”.

When registering, specify:

• The name is how the app will be seen by people on the login page.
• The type of application. “Public” — a website in a browser or mobile application: there is no secret, PKCE protects the entrance. “Private” — its own server that stores the client's secret. The type does not change after registration.
• The website of the application (https only) and, optionally, the address of the logo (https, square image).
• Return addresses — one per line, up to 10: https only, or http on localhost, 127.0.0.1 or [::1] for development. Without asterisks and “#”; the address is compared character by character, along with the port and path.
• What the application can request is from the list above; the person will be shown only what the application actually requested.

After registration, the application has a “Customer ID” (starts from vc_). A closed application is immediately shown the client's secret (starts with vcs_) — once: VISH stores only his fingerprint. A lost or illuminated secret is replaced with a “New Secret” button: the old one stops working immediately. “Delete” revokes all tokens and people's permissions issued to the application, and this cannot be revoked. Up to 10 applications per owner.

The page also has a “Setup Address (OpenID Connect)”: login libraries read all addresses and keys from it, so specify it instead of individual addresses. The protocol is OAuth 2.1 and OpenID Connect, only the Authorization Code with PKCE (S256), tokens are received only in response to a token request and never in the page address. Through the API, the app can only read schedules and notes for couples, and only with a person's permission.

For administrators

Тот, у кого есть право «Просмотр всех приложений „Войти через ВИШ“, их приостановка и возобновление» (по умолчанию — администратор), видит на странице «Заявки» вкладку «Вход через ВИШ»: все зарегистрированные приложения всех разработчиков. «Остановить» с причиной сразу перестаёт пускать людей в приложение, а его токены и чтение через API отклоняются; причину видит разработчик на своей странице. «Возобновить» снова включает вход, но токены, выданные до остановки, не оживают — людям нужно будет войти заново. Регистрация, изменение, новый секрет, удаление, остановка и возобновление приложений, а также разрешения и их отзыв записываются в журнал аудита.

Verified: 2026-10, PWA fbb681a8, platform 3474bfa8._