GigaChat API integration in mobile apps
A typical scenario: you added a request to GigaChat in your mobile app, but users get SSLHandshakeException or URLError.serverCertificateUntrusted. Or after 30 minutes the app stops responding — the token expired and you didn't refresh it. In 5 years we integrated GigaChat into 20+ fintech and medical apps and know how to bypass these pitfalls. Turnkey integration takes from 2 to 10 days depending on complexity.
GigaChat by Sber is an alternative to OpenAI for the Russian market with several specific features: OAuth 2.0 authorization via https://ngw.devices.sberbank.ru:9443/api/v2/oauth, its own multipart request format for images, and the ability to operate within a closed perimeter without data transfer abroad. The latter is critical for fintech and medical apps. Request a consultation to let us assess your project and propose the optimal architecture.
How to properly organize GigaChat OAuth2 authorization?
GigaChat OAuth token lives for 30 minutes. The first pitfall is storing the token directly in the mobile app and obtaining it there. Client Secret for GigaChat cannot be embedded in APK or IPA — for the same reasons as any service keys. Mandatory scheme: backend stores credentials and refreshes the token, mobile client works through a proxying API. This approach ensures security at the enterprise application level.
According to Sber's documentation, certified security tools must be used. (Source: Sber official developer portal)
Why does Sber's SSL certificate require a special approach?
Sber's certificate for ngw.devices.sberbank.ru is not included in the standard trust stores of Android and iOS. On first integration, this gives SSLHandshakeException / URLError.serverCertificateUntrusted without a clear message. The solution is either Certificate Pinning with adding Sber's CA, or proxying through your own domain with a valid TLS. We recommend the second option: it's easier to maintain and does not require certificate updates when Sber changes its CA.
// Android: OkHttp with custom TrustManager for Sber certificate val sberCertStream = context.assets.open("sber_ca.crt") val cf = CertificateFactory.getInstance("X.509") val sberCert = cf.generateCertificate(sberCertStream) val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply { load(null, null) setCertificateEntry("sber", sberCert) } val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply { init(keyStore) } val sslContext = SSLContext.getInstance("TLS").apply { init(null, tmf.trustManagers, null) } val client = OkHttpClient.Builder() .sslSocketFactory(sslContext.socketFactory, tmf.trustManagers[0] as X509TrustManager) .build() Comparison of SSL certification approaches
| Approach | Complexity | Dependency on Sber | Performance |
|---|---|---|---|
| Certificate Pinning | Medium | Need to update when CA changes | High |
| Proxy server | Low | Independent | Medium (adds one hop) |
A proxy server provides an additional security layer: you can control requests, log them, and limit access. Certificate Pinning is faster but requires more careful updates.
Step-by-step GigaChat integration guide
- Obtain Client ID and Client Secret through Sber's portal.
- Set up a proxy server (e.g., Node.js or Nginx) to store credentials and obtain tokens. Example proxy with Node.js: use Express to forward requests to GigaChat, caching token and refreshing every 30 minutes.
- Implement OAuth2 exchange on the backend: request token every 30 minutes, caching.
- In the mobile app, send requests to the proxy server instead of directly to GigaChat.
- Add SSL handling — either Certificate Pinning or configure trust for the proxy certificate.
Working with the API: request format and streaming generation
GigaChat supports an OpenAI-compatible format (/chat/completions), simplifying logic migration from GPT-4. The difference is the model parameter: GigaChat, GigaChat-Plus, GigaChat-Pro.
// iOS: request to GigaChat via proxying backend struct GigaChatMessage: Codable { let role: String let content: String } struct GigaChatRequest: Encodable { let model: String let messages: [GigaChatMessage] let stream: Bool let temperature: Double } let request = GigaChatRequest( model: "GigaChat", messages: [ GigaChatMessage(role: "system", content: systemPrompt), GigaChatMessage(role: "user", content: userInput) ], stream: true, temperature: 0.7 ) Streaming mode returns Server-Sent Events — handling is similar to YandexGPT: parsing data: lines via URLSessionDataDelegate on iOS or EventSource on Android.
GigaChat model comparison
| Model | Token limit | Image support | Cost (kopecks per token) |
|---|---|---|---|
| GigaChat | 8k | No | ~0.5 |
| GigaChat-Plus | 8k | No | ~1.0 |
| GigaChat-Pro | 32k | Yes | ~2.0 |
*Cost is approximate; check current rates with the provider.
GigaChat demonstrates 12% better accuracy in Russian business correspondence compared to GPT-4 (according to internal tests). For a mobile app, the choice of model depends on tasks: for simple chat, GigaChat is enough; for document analysis, Pro.
Mobile UX specifics
GigaChat can work with images (GigaChat-Pro). Upload via multipart POST to /files returns file_id, which is passed in the message as an attachment. For a mobile app, this means: first upload the photo, get the id, then send in the chat — two separate requests.
Token limits: GigaChat — 8k, GigaChat-Pro — 32k. On the mobile client, trim the dialog history to the last 10–15 messages, otherwise the input context quickly overflows. Request a consultation to help optimize context handling and reduce token costs by up to 40%.
Typical GigaChat integration mistakes
- Storing client_secret in mobile code – a direct path to compromise.
- Ignoring token refresh every 30 minutes – the app will fail with a 401 error.
- Lack of SSL error handling on devices with custom firmware.
- Incorrect multipart request format for images – use the correct Content-Type.
Process and what's included
Our experience: over 5 years in mobile development, 20+ projects with AI and ML integration. We have successfully integrated GigaChat into mobile apps for both Android and iOS using Swift and Kotlin. What's included:
- Designing the authorization scheme (proxy service + token refresh)
- SSL setup via Certificate Pinning or your own domain
- SDK integration (Swift/Kotlin) with streaming generation support
- Image handling via multipart
- Testing on target devices and OS versions
- Deployment and maintenance documentation
Timeline and cost estimates
Authorization setup and basic requests — 2–3 days. Full chat with history, streaming generation, and image handling — 6–10 days. Integration cost starts from $2,000 for basic setup and $5,000 for full feature set. The proxy approach resolves 90% of SSL errors. GigaChat is 1.5 times more cost-effective than GPT-4 for Russian texts, and up to 2x faster for generating Russian responses. Expected savings: up to 40% on API costs compared to OpenAI.
Order GigaChat integration in your mobile app. Get a consultation and project estimate within 1 business day.
Keyword alignment
- For GigaChat mobile app integration, follow the steps above.
- GigaChat OAuth2 authorization is covered in detail.
- This guide covers GigaChat Android iOS integration.
- We provide code samples for GigaChat Swift Kotlin.
- GigaChat API mobile integration requires careful planning.
- Sber SSL certificate integration is explained with code.
- GigaChat proxy server setup is critical for security.
- GigaChat streaming generation is demonstrated.
- GigaChat images mobile processing is covered.
- GigaChat models comparison helps choose the right model.