GigaChat AI-Assistant Integration for Mobile Apps

GigaChat AI-Assistant Integration for Mobile Apps

Mobile applications in the financial and healthcare sectors must store data within Russia. GigaChat is the only major language model with servers in the Russian jurisdiction. We have integrated it into 15+ projects, from banking chatbots to document analytics. The process from signing to deployment takes two to four weeks. Assess your scenario — contact us for a preliminary audit.

Problems We Solve

1. Legal data isolation. GigaChat runs on Sber's servers in Russia, the only option for apps where Federal Law 152-FZ requires local storage. YandexGPT also operates in Russia, but GigaChat offers more flexible B2B adaptation with corporate plans and dedicated resources. For example, clients with high request volumes get a dedicated endpoint with guaranteed throughput.

2. OAuth 2.0 with short-lived tokens. GigaChat's access_token lives 30 minutes. Direct retrieval on a mobile device is unsafe — client_id and client_secret must remain on the server only. We design a server proxy that handles authentication and issues the token to the client. This reduces the risk of credential leakage.

3. Non-standard root certificates. Sber uses its own CA from the Ministry of Digital Development registry. In production, you must explicitly add these certificates to the trust store — otherwise the HTTPS connection will fail. We have configured this under iOS (via ATS), Android (Network Security Config), and server platforms. No performance loss — connection setup time increases by no more than 5%.

How to Authenticate with GigaChat API

The protocol is OAuth 2.0 with client_credentials grant type:

POST https://ngw.devices.sberbank.ru:9443/api/v2/oauth Authorization: Basic {base64(client_id:client_secret)} Content-Type: application/x-www-form-urlencoded scope=GIGACHAT_API_CORP 

The token is returned in JSON with fields access_token and expires_at. On the mobile client we do not store secrets — all requests go through our server proxy, which obtains the token and passes it to the client over a secure channel. Example server code (Python):

# Server side (Python) — obtaining a token import httpx, base64, time class GigaChatAuth: def __init__(self, client_id: str, client_secret: str): self._credentials = base64.b64encode( f"{client_id}:{client_secret}".encode() ).decode() self._token = None self._expires_at = 0 async def get_token(self) -> str: if time.time() < self._expires_at - 60: return self._token async with httpx.AsyncClient(verify=False) as client: resp = await client.post( "https://ngw.devices.sberbank.ru:9443/api/v2/oauth", headers={"Authorization": f"Basic {self._credentials}"}, data={"scope": "GIGACHAT_API_CORP"} ) data = resp.json() self._token = data["access_token"] self._expires_at = data["expires_at"] / 1000 return self._token 

Reference: GigaChat API Specification (current version). Important: verify=False is only acceptable for testing. In production, attach the Ministry of Digital Development certificates (e.g., via a cacert.pem file).

Why a Server Proxy Is Mandatory

Using the GigaChat API directly from a mobile device is a serious security mistake. client_secret is the key to your account. If it is compromised, an attacker can generate tokens at your expense. The proxy solves this: it stores the secret, and the mobile app receives only a temporary token. Additionally, the proxy allows you to:

• Cache tokens and reduce the number of requests to GigaChat (saving up to 40% on limits).
• Log all requests for auditing.
• Add custom business logic (e.g., content moderation or A/B testing).

Which GigaChat Model Suits Your Application?

GigaChat-Pro is 2-3 times more accurate on data extraction and financial analysis tasks. If your assistant must work with reports and charts, choose Pro. In our projects, data extraction accuracy from reports reaches 95%.

How Function Calling Simplifies Backend Integration

GigaChat supports function calls via the functions parameter. The syntax differs from OpenAI: the field is called functions (not tools), and the call comes in function_call (not tool_calls). This is the first thing that breaks when migrating. Example request:

{ "functions": [{ "name": "get_account_balance", "description": "Get the client's account balance", "parameters": { "type": "object", "properties": { "account_id": {"type": "string"} }, "required": ["account_id"] } }], "function_call": "auto" } 

We have implemented this pattern in several projects — the assistant itself decides when to call a function and returns structured data. This allows integration with any REST API without manual parsing.

Working with Images

GigaChat Pro allows uploading images via the file API. Steps:

1. Upload the file via POST /api/v1/files with purpose: general. Maximum size is 20 MB.
2. Obtain the file_id.
3. Pass it in a message as image_url: https://gigachat.ru/files/{file_id}/content.

The file is deleted after 24 hours — important to consider in design. For critical data, we recommend extracting immediately.

What Is Included in the Work

• Server proxy with OAuth 2.0 (Python/Go/Node.js).
• Mobile SDK for iOS/Android/Flutter with token handling and streaming (SSE).
• Configuration of Russian root certificates for production.
• Implementation of function calling for your business logic.
• Integration with the file API (if images are needed).
• Documentation for deployment and support.

Work Process

For certificate setup: on iOS we use ATS, on Android — Network Security Config. On the server we update the CA bundle. We have prepared step-by-step instructions for each platform.

Estimated Timeline

• Basic text assistant (proxy + chat interface): from 1.5 to 2 weeks.
• With function calling and images: from 3 to 4 weeks.

The cost is calculated individually. For an accurate estimate, contact us — we will prepare a proposal for your project.