GigaChat AI-Assistant Integration for Mobile Apps

GigaChat AI-Assistant Integration for Mobile Apps

Mobile applications in the financial and healthcare sectors must store data within Russia. GigaChat is the only major language model with servers in the Russian jurisdiction. We have integrated it into 15+ projects, from banking chatbots to document analytics. The process from signing to deployment takes two to four weeks. Assess your scenario — contact us for a preliminary audit.

Problems We Solve

1. Legal data isolation. GigaChat runs on Sber's servers in Russia, the only option for apps where Federal Law 152-FZ requires local storage. YandexGPT also operates in Russia, but GigaChat offers more flexible B2B adaptation with corporate plans and dedicated resources. For example, clients with high request volumes get a dedicated endpoint with guaranteed throughput.

2. OAuth 2.0 with short-lived tokens. GigaChat's access_token lives 30 minutes. Direct retrieval on a mobile device is unsafe — client_id and client_secret must remain on the server only. We design a server proxy that handles authentication and issues the token to the client. This reduces the risk of credential leakage.

3. Non-standard root certificates. Sber uses its own CA from the Ministry of Digital Development registry. In production, you must explicitly add these certificates to the trust store — otherwise the HTTPS connection will fail. We have configured this under iOS (via ATS), Android (Network Security Config), and server platforms. No performance loss — connection setup time increases by no more than 5%.

How to Authenticate with GigaChat API

The protocol is OAuth 2.0 with client_credentials grant type:

POST https://ngw.devices.sberbank.ru:9443/api/v2/oauth
Authorization: Basic {base64(client_id:client_secret)}
Content-Type: application/x-www-form-urlencoded

scope=GIGACHAT_API_CORP

The token is returned in JSON with fields access_token and expires_at. On the mobile client we do not store secrets — all requests go through our server proxy, which obtains the token and passes it to the client over a secure channel. Example server code (Python):

# Server side (Python) — obtaining a token
import httpx, base64, time

class GigaChatAuth:
    def __init__(self, client_id: str, client_secret: str):
        self._credentials = base64.b64encode(
            f"{client_id}:{client_secret}".encode()
        ).decode()
        self._token = None
        self._expires_at = 0

    async def get_token(self) -> str:
        if time.time() < self._expires_at - 60:
            return self._token
        async with httpx.AsyncClient(verify=False) as client:
            resp = await client.post(
                "https://ngw.devices.sberbank.ru:9443/api/v2/oauth",
                headers={"Authorization": f"Basic {self._credentials}"},
                data={"scope": "GIGACHAT_API_CORP"}
            )
        data = resp.json()
        self._token = data["access_token"]
        self._expires_at = data["expires_at"] / 1000
        return self._token

Reference: GigaChat API Specification (current version). Important: verify=False is only acceptable for testing. In production, attach the Ministry of Digital Development certificates (e.g., via a cacert.pem file).

Why a Server Proxy Is Mandatory

Using the GigaChat API directly from a mobile device is a serious security mistake. client_secret is the key to your account. If it is compromised, an attacker can generate tokens at your expense. The proxy solves this: it stores the secret, and the mobile app receives only a temporary token. Additionally, the proxy allows you to:

• Cache tokens and reduce the number of requests to GigaChat (saving up to 40% on limits).
• Log all requests for auditing.
• Add custom business logic (e.g., content moderation or A/B testing).

Which GigaChat Model Suits Your Application?

GigaChat-Pro is 2-3 times more accurate on data extraction and financial analysis tasks. If your assistant must work with reports and charts, choose Pro. In our projects, data extraction accuracy from reports reaches 95%.

How Function Calling Simplifies Backend Integration

GigaChat supports function calls via the functions parameter. The syntax differs from OpenAI: the field is called functions (not tools), and the call comes in function_call (not tool_calls). This is the first thing that breaks when migrating. Example request:

{
  "functions": [{
    "name": "get_account_balance",
    "description": "Get the client's account balance",
    "parameters": {
      "type": "object",
      "properties": {
        "account_id": {"type": "string"}
      },
      "required": ["account_id"]
    }
  }],
  "function_call": "auto"
}

We have implemented this pattern in several projects — the assistant itself decides when to call a function and returns structured data. This allows integration with any REST API without manual parsing.

Working with Images

GigaChat Pro allows uploading images via the file API. Steps:

1. Upload the file via POST /api/v1/files with purpose: general. Maximum size is 20 MB.
2. Obtain the file_id.
3. Pass it in a message as image_url: https://gigachat.ru/files/{file_id}/content.

The file is deleted after 24 hours — important to consider in design. For critical data, we recommend extracting immediately.

What Is Included in the Work

• Server proxy with OAuth 2.0 (Python/Go/Node.js).
• Mobile SDK for iOS/Android/Flutter with token handling and streaming (SSE).
• Configuration of Russian root certificates for production.
• Implementation of function calling for your business logic.
• Integration with the file API (if images are needed).
• Documentation for deployment and support.

Work Process

For certificate setup: on iOS we use ATS, on Android — Network Security Config. On the server we update the CA bundle. We have prepared step-by-step instructions for each platform.

Estimated Timeline

• Basic text assistant (proxy + chat interface): from 1.5 to 2 weeks.
• With function calling and images: from 3 to 4 weeks.

The cost is calculated individually. For an accurate estimate, contact us — we will prepare a proposal for your project.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.