Odnoklassniki Chatbot Mobile Development
OK API returns 403 Forbidden on the first request if you miss a subtlety with signature format. Most projects stumble at the authentication stage — the actual bot logic never gets built for weeks.
How OK API Integration Works
Odnoklassniki uses its own request signature scheme. Each call to api.ok.ru/fb.do requires computing an MD5 hash from the concatenation of sorted parameters + session key + application secret. Miss the sorting — signature is invalid, response is invalid_session.
A mobile application communicates with the bot through an intermediary server: client sends message → server receives webhook from OK → processes logic → replies via messages.send. Never store application_secret_key on the device.
A webhook event from OK arrives in this format:
{
"type": "NEW_MESSAGE",
"senderId": "123456789",
"groupId": "70000000000001",
"object": {
"body": "Hello",
"mid": "MESSAGE_ID"
}
}
On the mobile app side, it's a standard REST client: Retrofit on Android or Alamofire on iOS, which polls your server or connects via WebSocket for real-time responses.
What Actually Needs Implementation
Authorization via OK OAuth. If the bot acts on behalf of a user (not a group), you need an access_token with MESSAGES rights. The OK mobile SDK for Android (one-sdk-android) simplifies the OAuth flow, but for custom UX, you'll need a WebView with redirect URI interception.
Broadcasting to group subscribers. notifications.sendSimple works only if the user has engaged with the group. Attempting to send without prior contact returns user_not_invited_to_group. This is a platform limitation that can't be bypassed.
Auto-replies in groups. The bot monitors GROUP_MESSAGE_NEW via Long Polling or Callback API. Callback API is more reliable — Long Polling requires maintaining a persistent connection, which is suboptimal on a mobile server.
Development Process
Registering the application in OK Dev Center, setting up group permissions and webhook endpoint.
Server-side: handling OK request signatures, routing incoming events, storing dialog history.
Mobile client: chat UI (RecyclerView + DiffUtil on Android, UICollectionView with compositional layout on iOS), integration with your API.
Testing on real OK accounts — emulators don't help here, you need live profiles.
Timeline Estimates
A basic bot with auto-replies in a group and mobile interface — 3–5 days. If broadcasts, dialog analytics, and CRM integration are needed — 2–3 weeks.