GigaChat API Integration into Mobile App

GigaChat API Integration in Mobile Applications

GigaChat from Sber is an OpenAI alternative for the Russian market with several specific features: OAuth 2.0 authorization via https://ngw.devices.sberbank.ru:9443/api/v2/oauth, custom multipart request format for working with images, and ability to operate within closed loop without sending data abroad. The last point is critical for fintech and medical apps.

Authorization: Common Pitfalls

GigaChat OAuth token lives 30 minutes. First trap — storing token directly in mobile app and obtaining it there. Client Secret for GigaChat can't be embedded in APK or IPA — same reasons as any service key. Mandatory scheme: backend stores credentials and refreshes token, mobile client works through proxying API.

Sber's certificate for ngw.devices.sberbank.ru isn't included in standard Android and iOS trust stores. On first integration this causes SSLHandshakeException / URLError.serverCertificateUntrusted without clear message. Solution — either Certificate Pinning with Sber CA added, or proxying through own domain with valid TLS.

// Android: OkHttp with custom TrustManager for Sber certificate
val sberCertStream = context.assets.open("sber_ca.crt")
val cf = CertificateFactory.getInstance("X.509")
val sberCert = cf.generateCertificate(sberCertStream)

val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
    load(null, null)
    setCertificateEntry("sber", sberCert)
}
val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply {
    init(keyStore)
}
val sslContext = SSLContext.getInstance("TLS").apply {
    init(null, tmf.trustManagers, null)
}
val client = OkHttpClient.Builder()
    .sslSocketFactory(sslContext.socketFactory, tmf.trustManagers[0] as X509TrustManager)
    .build()

Working with API: Request Format

GigaChat supports OpenAI-compatible format (/chat/completions), simplifying logic porting from GPT-4. Difference is in model parameter: use GigaChat, GigaChat-Plus, GigaChat-Pro.

// iOS: request to GigaChat through proxying backend
struct GigaChatMessage: Codable {
    let role: String
    let content: String
}

struct GigaChatRequest: Encodable {
    let model: String
    let messages: [GigaChatMessage]
    let stream: Bool
    let temperature: Double
}

let request = GigaChatRequest(
    model: "GigaChat",
    messages: [
        GigaChatMessage(role: "system", content: systemPrompt),
        GigaChatMessage(role: "user", content: userInput)
    ],
    stream: true,
    temperature: 0.7
)

Streaming mode returns Server-Sent Events — handling similar to YandexGPT: parse data: lines via URLSessionDataDelegate on iOS or EventSource on Android.

Mobile UX Considerations

GigaChat can work with images (GigaChat-Pro). Upload via multipart POST to /files returns file_id, passed in message as attachment. For mobile app this means: first upload photo, get id, then send to chat — two separate requests.

Token limits: GigaChat — 8k, GigaChat-Pro — 32k. On mobile client, truncate conversation history to reasonable message count (10–15 recent), otherwise input context fills quickly.

Implementation Process

Design proxy service with OAuth token management and automatic refresh. Resolve SSL issue (Sber CA or own domain). Choose model for scenario. Integrate streaming chat into mobile app with typical bubble UI. Test Russian language answer quality — GigaChat excels at business communication and financial text.

Timeline Guidelines

Setup authorization and basic requests — 2–3 days. Full chat with history, streaming generation, and image handling — 6–10 days.