SMeetMini Apps
Sections and contents

Sections

On this page

SMeet Mini Apps

Overview

A Mini App is a web page of a bot's author that opens inside SMeet, in a window over the chat with the bot. The person signs in through SMeet with one tap, and what they fill in reaches the bot after they confirm it.

What a Mini App is#

A bot can have one Mini App. It is an ordinary web page on the author's own HTTPS server: a form, a request desk, a booking screen, a small tool. SMeet shows it in a window over the chat with the bot, tells the person whose page it is and what it receives, and connects the page to SMeet through a small script, the SDK.

  • The page and its server are the author's. SMeet does not host them and does not run their code.
  • The person signs in with their SMeet account without a password and without cookies: the page asks SMeet for a one-time login code, and the author's server exchanges it for a session (Sign-in).
  • The page can send a result to the bot. SMeet first shows the person what goes, and the bot receives it as a mini_app_submission update in the same queue as messages (Mini Apps in the Bot API).
  • Mini Apps sell nothing and take no payments (Rules for authors).

How the parts fit#

PartWhoseWhat it does
The pagethe author'sthe interface; loads the SDK on every page
The SDKSMeet's, inside the pageconnects to the SMeet window, gets login codes, sends results to the bot (SDK)
The SMeet windowSMeet'sshows the consent screen, the domain of the page, the confirmation of every result; loads the page in a frame
The author's serverthe author'sexchanges login codes for sessions and checks them with SMeet (Your server)
The botthe author'sreceives the results and answers in the chat (Bot API)

A launch goes like this:

  1. The person presses a mini_app button in the chat with the bot or opens a link https://messenger.scrile.com/u/<bot>?startapp=<param>.
  2. SMeet shows a consent screen: who made the app, what it receives about the person, and that loading the app shows the author's server their IP address and device information. Nothing goes to the author before the person presses Open.
  3. SMeet opens the window and loads the page of the published version.
  4. The page connects with SMeetMiniApp.connect() and calls ready() when its first screen is drawn.
  5. The page signs the person in: its server gives it a one-time login attempt, authorize() gives a code, and the server exchanges the code with exchangeLaunchCode.
  6. The page works with its own server. Before every protected operation the server checks the session with checkSession, without a cache.
  7. When the person sends a form, submitToBot() shows SMeet's confirmation, and the bot receives the form.
  8. The bot answers in the chat, with the revision of the conversation as a condition.

Where Mini Apps open#

In the SMeet web app and in SMeet for iOS, iPadOS and macOS. On a wide screen the window stands in the middle and can be expanded; on a phone it takes the whole screen.

Other apps and older versions do not open Mini Apps: SMeet for Android, the desktop app and older versions of the web app and of SMeet for iOS show the mini_app button inactive and explain nothing. Say in the text of the message where the form opens (The mini_app button).

Two environments#

Every Mini App has two versions, each on an origin of its own and with keys of its own:

ProductionTest
What opensthe published configuration, reviewedthe draft if there is one, also in review or after a refusal; otherwise the published configuration
Who opens iteveryone who may see the botthe owner, the testers who accepted an invitation, the reviewers of an open review
Marked"Test version, not reviewed by SMeet" in the consent screen and the window
Its linkhttps://messenger.scrile.com/u/<bot>?startapp=the same with &env=test

The two environments never share a session or a result. Details are in Publishing.

What SMeet takes care of#

  • The trusted screens: the consent before every launch, the domain in the bar of the window, the confirmation of every result and of every external link. A page cannot draw over them or press them.
  • Who the person is: the login code goes only to the page SMeet loaded and checked, and only the author's server with the key of this app and environment can exchange it.
  • Ending access: when the person stops or blocks the bot, revokes the app's access, leaves the organisation or signs out, SMeet closes the window, and checkSession answers active: false at once.

SMeet reviews an app of the public space before it is published, but not every later change of the author's site. The author answers for the app, its data and its server (Rules for authors).

Versions#

  • SDK 1.0.0, the bridge of version 1 and its bridge.schema.json.
  • The author API 1.0.0 at https://messenger.scrile.com/mini-app-api/v1, described by openapi.json.
  • The mini_app button and the mini_app_submission update come with Bot API 1.2.0.

Every change is listed in the changelog.

Where to start#