skills.rest
VKirill
VKirillCOMMUNITY
Explore all skills by this author →
GitHub

vk-bridge

Validate VK Mini App launch parameters with HMAC-SHA256 and base64url encoding.

15|2|Updated May 23, 2026
Search Tags:#idempotency#server-side auth#vk bridge#hmac validation#vk mini apps#vk pay#community admin
One-click install
npx skills add https://github.com/VKirill/antigravity-for-claude-code --skill vk-bridge
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vk-bridge
Source: https://github.com/VKirill/antigravity-for-claude-code/tree/main/skills/vk-bridge
Command: npx skills add https://github.com/VKirill/antigravity-for-claude-code --skill vk-bridge

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

vk-bridge helps you build VK Mini Apps that can securely identify users, handle VK Pay payments, and interact with native VK features without trusting forgeable client launch parameters.

Core Features & Use Cases

  • Server-side HMAC launch-param validation: verify the VK Mini App vk_* parameters using HMAC-SHA256 with base64url no-padding to establish a trusted identity boundary.
  • Identity & OAuth flows: retrieve profile data and request OAuth tokens for VK API calls via VKWebAppGetUserInfo, VKWebAppGetEmail, VKWebAppGetPhoneNumber, and VKWebAppGetAuthToken.
  • Payments & notifications: open VK Pay forms with VKWebAppOpenPayForm and send in-VK notifications using VKWebAppAllowNotifications plus server-side messages.send with proper intent handling.
  • Use case example: building a subscription purchase flow where the app opens VK Pay, then your server confirms the transaction_id, enforces idempotency, and only then grants premium.

Quick Start

Use the vk-bridge skill to validate VK Mini App launch params including secure HMAC-SHA256 sign checking before trusting vk_user_id.

Frequently Asked Questions about vk-bridge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate VK Mini App launch parameters securely on the server?▼

Server-side VK Mini App validation uses HMAC-SHA256 to verify vk_* launch parameters, applying base64url no-padding encoding and timing-safe comparisons to prevent forged client identities. Replay-window checks add production reliability.

What is the correct way to handle VK Pay payment initiation and confirmation?▼

Initiate VK Pay by calling VKWebAppOpenPayForm to open native payment forms, then confirm the transaction_id on your server and enforce idempotency before granting entitlements to ensure reliable payment processing.

How do I retrieve user profile data and OAuth tokens in a VK Mini App?▼

Retrieve user profile data and OAuth tokens via @vkontakte/vk-bridge methods including VKWebAppGetUserInfo, VKWebAppGetEmail, VKWebAppGetPhoneNumber, and VKWebAppGetAuthToken to enable server-side VK API calls.

Can I use @vkontakte/vk-bridge for server-side community admin gating?▼

Yes, @vkontakte/vk-bridge supports community admin gating by validating vk_* launch parameters through server-side HMAC sign verification, ensuring only authorized community admins gain access to restricted features.

Why does my VK Mini App authentication fail due to replay attacks?▼

VK Mini App authentication fails due to replay attacks when replay-window checks are missing. Production reliability requires enforcing timestamp freshness alongside canonical HMAC-SHA256 sign verification to prevent replayed requests.

Related Skills

Explore More Legal & Compliance Skills→
ydnikolaevydnikolaev
8

telegram-mechanic

Configure Telegram Bot API webhooks with HMAC-SHA256 validation for Go backends.

Community
Advanced
epieczkoepieczko

agent.run

Execute Betty agents by loading manifests, generating prompts, invoking Claude API, and logging results.

Community
Advanced
git-taogit-tao

calendly

Automate Calendly API v2 integration for scheduling URLs, embeds, and webhooks.

Community
Basic
atilladenizatilladeniz
2

data-fetching

Enforce Orval-generated API wrappers with TanStack Query HydrationBoundary for data fetching.

Community
Intermediate