Development of Authorization via Yandex ID
Imagine: a user just installed your app, opens the login screen and sees a "Log in with Yandex" button. One tap — and they are already in the system. But behind the scenes, a complex OAuth 2.0 dance is happening: the app must register a URL Scheme, correctly handle the redirect URI, obtain and verify the access token. Any mistake — and the user gets stuck in an endless redirect cycle or receives a 401 with an obscure message. For 5+ years we have integrated Yandex ID into 50+ projects for iOS and Android, and we know every pitfall. Let's talk about the technical details that help avoid typical mistakes, saving up to 40% of development time.
How to Integrate Yandex ID SDK on iOS?
Yandex provides YandexLoginSDK for iOS (available via SPM and CocoaPods) and Android (via Gradle). In the developer console at oauth.yandex.ru, create an app, specify the redirect URI, and get the client_id.
On iOS, add the URL Scheme yx{client_id} to Info.plist. The SDK opens authorization in SFSafariViewController (stays within the app, unlike Custom Tabs on Android) — Yandex does not use a native app-to-app flow unlike VK.
// iOS YandexLoginSDK.shared.set(clientID: "YOUR_CLIENT_ID") // Start authorization try YandexLoginSDK.shared.authorize( with: self, // UIViewController customValues: nil ) // In AppDelegate/SceneDelegate — handle redirect func application(_ app: UIApplication, open url: URL, options: [...]) -> Bool { return YandexLoginSDK.shared.handleOpen(url, sourceApplication: options[...]) } After authorization, we get a token (OAuth2 access token). To get user data, make a request to login.yandex.ru/info?format=json with the header Authorization: OAuth {token}. The response contains id, login, default_email, real_name, default_avatar_id.
User avatar: https://avatars.yandex.net/get-yapic/{default_avatar_id}/islands-200 — standard URL for fetching a photo of the desired size.
Server-side token verification: GET https://login.yandex.ru/info?oauth_token={token} — if the token is valid, it returns user data. That is verification: an invalid token returns 401.
Why Native SDK Is 10 Times Safer Than WebView?
Native integration via SDK ensures correct OAuth2 flow, automatic session management, and built-in refresh token support. WebView is less secure and can be blocked by browsers. According to OWASP, native SDK reduces the risk of token interception by an order of magnitude — 10 times fewer vulnerabilities related to XSS and cross-site requests.
| Approach | Security | Refresh Support | Integration Time |
|---|---|---|---|
| Native SDK | High (OIDC) | Automatic | 3-6 days |
| WebView | Low (XSS) | Manual | from 5 days |
| Manual OAuth 2.0 | Medium | Requires implementation | from 7 days |
What Data Does Yandex ID Expose?
A standard API request returns: unique id, login, email (if allowed), name, and avatar. To get additional data, extended scopes are required (e.g., login:phone). Important: email is not always mandatory — the user may hide it. Requesting a large amount of data increases the likelihood of user rejection — request only what is truly needed.
| Scope | Data | Access Level |
|---|---|---|
login:email |
user email | Basic |
login:avatar |
avatar | Basic |
login:phone |
phone number | Extended |
A common mistake is to require a phone number unnecessarily. This increases the rejection rate by 20-30%. Optimally, start with a minimal set and request more as needed.
What Is Included in Yandex ID Integration?
We perform the full cycle:
- Setting up SDK for iOS and Android (Swift/Kotlin) considering OS versions and architecture
- Configuring URL Scheme and redirect URI (including Universal Links support for iOS)
- Implementing token request and response handling (including refresh token and Keychain storage)
- Server-side token verification on any backend (Node.js, PHP, Python, Ruby)
- Integration documentation and 30-day support after delivery
We also help with app store publication: check compliance with App Store Review Guidelines (especially section 4.2 about minimal functionality) and Google Play Policy.
Timelines: 3-6 working days. Cost is calculated individually for your project — we assess the scope and complexity. Contact us for a consultation.
How Does the Integration Process Work?
- Analysis: we study your app's architecture, identify authorization entry points.
- Design: we design the OAuth2 flow considering Yandex ID specifics (JWT and OIDC).
- Implementation: we write code in Swift and Kotlin, configure the SDK.
- Testing: we verify all scenarios — success, rejection, network errors, token expiration.
- Deployment: we integrate into your CI/CD, update documentation.
Team Experience
Our engineers are certified iOS and Android developers with 5+ years of experience. We have completed over 100 projects with authorization, of which 50+ are specifically Yandex ID. We guarantee compliance with app store requirements. Get a consultation today.