SMeetMini Apps
Sections and contents

Sections

On this page

SMeet Mini Apps

Quick start

From a bot to a working test version in seven steps. You need a bot of your own, a server with HTTPS and about half an hour.

What you need#

  • A bot of your own in SMeet. If you have none yet, create one with SMeet BotFather (Bot API quick start).
  • Two HTTPS origins under your control, one for the production version and one for the test version, for example https://forms.example.com and https://test.forms.example.com. Addresses on scrile.com and IP addresses are not accepted (Addresses).
  • For the examples: Node.js 22.13 or newer, or Python 3.9 or newer.

1. Create the Mini App#

Open My bots in SMeet, choose the bot and open Mini app; in SMeet BotFather /miniapp leads to the same screen. Read and accept the Rules for authors, then press Create the mini app.

Fill in the settings:

  • the title and the description people see on the consent screen;
  • the production address and the test address, the pages people open, for example https://forms.example.com/ and https://test.forms.example.com/;
  • the links to your privacy policy and your support, both https://;
  • what the app receives: the id and the language always, the display name only if you tick The person's name;
  • Send a result to the bot, if the page calls submitToBot();
  • the age category; only 4+ is accepted now.

2. Confirm the domains#

For each version the screen shows a verification token. Serve it as a text file at /.well-known/smeet-mini-app.txt of that origin, on a line of its own, and press Check now:

Text
https://test.forms.example.com/.well-known/smeet-mini-app.txt

smeet-mini-app-Fy3xK0wQm9PZ2s7vTn4cLbJ8hR5dW1eGqA6uYt2N

The same check reads the headers of the address of each version. Send this header with every page of the app, so that only SMeet can show it in a frame:

HTTP
Content-Security-Policy: frame-ancestors https://messenger.scrile.com

Details and the other accepted forms are in Publishing.

3. Issue a key#

In Keys of your server issue a key for the test version. It is shown once: put it into the environment of your server right away, for example as MINI_APP_KEY. Your server uses it to exchange login codes and check sessions; it never goes into the page. Each version has keys of its own (Keys).

4. Run an example#

Download an example and run it on your test origin:

For the form:

Shell
unzip smeet-mini-apps-forms.zip && cd smeet-mini-apps-forms/examples/forms
cp .env.example .env
# in .env: MINI_APP_ENVIRONMENT=test, MINI_APP_KEY=<the key>, SMEET_BOT_TOKEN=<the bot token>, BOT_MODE=polling
node build.mjs --out dist --api-path /api/
STATIC_DIR=./dist node --env-file=.env server.mjs

The test process listens on 127.0.0.1:5102; put your HTTPS reverse proxy for the test origin in front of it. It sends the page with frame-ancestors https://messenger.scrile.com itself. BOT_MODE=polling makes this process the bot's receiver of updates, so the bot answers the forms; a bot has exactly one receiver, so once a production process runs, it takes that role and the test process gets BOT_MODE=off. Each archive has a README with every setting (Examples).

5. Open the test version#

The screen shows the link to the test version: https://messenger.scrile.com/u/<bot>?startapp=&env=test. Open it in SMeet. You see the consent screen marked "Test version, not reviewed by SMeet", then your page in the window.

If the window says "The app is not responding or does not allow embedding", the page did not connect within 15 seconds: check the frame-ancestors header and that the page loads the SDK in its <head> (When the window shows an error).

Invite testers by their username in Testers; they open the test version once they accept the invitation.

6. Send for review#

When both domains are confirmed, embedding is limited to SMeet for both versions, and the policy and support links are given, press Send for review. Mini Apps of SMeet's public space are reviewed by SMeet moderators; Mini Apps of an organisation by its owner and administrators (Review).

7. Let people open it#

Once published, the production version opens from a mini_app button that your bot sends in a private chat, and from the link https://messenger.scrile.com/u/<bot>?startapp=<param>:

JSON
{"text": "Open the form", "mini_app": {"start_param": "vpn-access"}}

The page reads the parameter as environment.startParam; your server gets it as start_param of the exchange (The mini_app button).

Next#

  • Sign-in: the login attempt, authorize() and the exchange.
  • Your server: checking the session before every operation and answering in the chat.
  • Interface: the keyboard, the theme and what the window does not allow.