skills.rest
VKirill
VKirillCOMMUNITY
Explore all skills by this author →
GitHub

max-bridge

Validates MAX messenger WebAppData initData identity and permissions via HMAC-SHA256 with TTL checks for ru.dev.max.xpi.dev.max.ru RU mini-apps server-side authorization flows endpoint security and Node constant-time comparison troubleshooting guidance. Ensures correct extraction and sorting of WebAppData params excluding hash from launch_params for Node-based RU mini-apps targeting dev.max.ru pla

15|2|Updated May 23, 2026
Search Tags:#mini-apps#hmac-sha256#identity security#max-bridge#initdata validation#ru market#webappdata
One-click install
npx skills add https://github.com/VKirill/antigravity-for-claude-code --skill max-bridge
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: max-bridge
Source: https://github.com/VKirill/antigravity-for-claude-code/tree/main/skills/max-bridge
Command: npx skills add https://github.com/VKirill/antigravity-for-claude-code --skill max-bridge

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Prevents forged or stale identity claims in MAX mini-apps by validating launch data server-side using the MAX Bridge rules for HMAC-SHA256, including correct hashing inputs and TTL enforcement.

Core Features & Use Cases

  • MAX WebApp bridge integration: Understand and use window.WebApp capabilities (e.g., DeviceStorage, SecureStorage, BiometricManager, HapticFeedback, NfcManager, BackButton, and share/open deep-link flows) with platform-aware guards.
  • Server-side initData validation: Implements the upstream 10-step MAX algorithm to verify window.WebApp.initData against the bot token, excluding hash from the signed payload and enforcing auth_date TTL.
  • Production hardening & debugging: Provides troubleshooting for common bridge/validation failures and “wrong vs right” patterns that block the highest-stakes identity mistakes.

Quick Start

Ask: “Validate MAX initData for my endpoint using HMAC-SHA256 with a 1-hour TTL, and show the correct error handling for signature mismatch or expired auth_date.”

Frequently Asked Questions about max-bridge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate MAX mini-app initData using HMAC-SHA256?▼

To validate MAX mini-app initData, extract and sort WebAppData params, exclude the hash from the launch payload, and verify it using the upstream two-step HMAC-SHA256 algorithm against your bot token. Constant-time comparison in Node ensures the initData is authentic.

What is the correct way to handle WebAppData auth_date TTL checks?▼

WebAppData TTL checks require strict enforcement of the auth_date parameter to prevent stale identity claims. You must verify that the auth_date falls within your defined time-to-live window, such as a 1-hour threshold, rejecting any expired requests.

How do I troubleshoot signature mismatch errors during initData validation?▼

Troubleshooting signature mismatch involves checking correct extraction and sorting of WebAppData params and ensuring hash is excluded from the signed payload. The Skill provides wrong vs right patterns to block high-stakes identity mistakes and resolve validation failures.

Why should I avoid using initDataUnsafe for server-side authorization?▼

Avoiding initDataUnsafe is critical because it prevents forged identity claims in MAX mini-apps. Server-side validation must use the verified initData instead, applying the HMAC-SHA256 algorithm and TTL checks to securely authenticate users.

Does MAX Bridge support endpoint protection for RU mini-apps targeting dev.max.ru?▼

Yes, MAX Bridge supports endpoint protection for RU mini-apps targeting dev.max.ru. It securely validates identity and platform-specific capabilities by wiring WebAppData initData checks into your server-side authorization flows.

Related Skills

Explore More Legal & Compliance Skills→
korjavinkorjavin

telegram-web-login

Integrate Telegram Login Widget authentication with signature validation for web apps.

Community
Advanced
team-telnyxteam-telnyx
3

telnyx-oauth-python

Implement OAuth 2.0 authentication flows for the Telnyx API with Python SDK examples.

Official
Intermediate
NKDShinKuNKDShinKu

vue-router-best-practices

Implement Vue Router 4 navigation guards in Vue 3 projects.

Community
Advanced
AndVl1AndVl1
4

telegram-mini-apps

Build Telegram Mini Apps with frontend toolkits and initData authentication flows.

Community
Intermediate