max-bridge

What problem does it solve?

Prevents forged or stale identity claims in MAX mini-apps by validating launch data server-side using the MAX Bridge rules for HMAC-SHA256, including correct hashing inputs and TTL enforcement.

Core Features & Use Cases

• MAX WebApp bridge integration: Understand and use window.WebApp capabilities (e.g., DeviceStorage, SecureStorage, BiometricManager, HapticFeedback, NfcManager, BackButton, and share/open deep-link flows) with platform-aware guards.
• Server-side initData validation: Implements the upstream 10-step MAX algorithm to verify window.WebApp.initData against the bot token, excluding hash from the signed payload and enforcing auth_date TTL.
• Production hardening & debugging: Provides troubleshooting for common bridge/validation failures and “wrong vs right” patterns that block the highest-stakes identity mistakes.

Quick Start

Ask: “Validate MAX initData for my endpoint using HMAC-SHA256 with a 1-hour TTL, and show the correct error handling for signature mismatch or expired auth_date.”