First request to api.ok.ru/fb.do returns 403 Forbidden — a classic pitfall for beginners. The cause lies in the signature format: each parameter must be sorted lexicographically, then concatenated with the session key and application secret, after which MD5 is computed. One missed sort — and the signature is invalid, response invalid_session. Over 5 years we have developed more than 20 chat bots for Odnoklassniki with OK API and know all the subtleties. Average response time of such a bot is 200 ms, and the cost per interaction is 5 times lower than that of a live operator. Our experience ensures you won't spend weeks debugging authentication. Contact us for a free project evaluation.
To compute the signature, collect all request parameters (except sig and access_token), sort them lexicographically, concatenate into a string like param1=value1param2=value2..., add the session key and application secret, then compute MD5. Python example:
import hashlib
params = sorted(params.items())
raw = ''.join(f'{k}={v}' for k, v in params) + session_key + secret
sig = hashlib.md5(raw.encode()).hexdigest()
Webhook event from OK arrives in the format:
{
"type": "NEW_MESSAGE",
"senderId": "123456789",
"groupId": "70000000000001",
"object": {
"body": "Hello",
"mid": "MESSAGE_ID"
}
}
On the mobile app side, it is a regular REST client: Retrofit on Android or Alamofire on iOS, which polls your server or connects via WebSocket to receive responses in real time.
Mobile Chat Bot Architecture for Odnoklassniki
Odnoklassniki uses its own request signing scheme. Each call to api.ok.ru/fb.do requires computing an MD5 hash from the concatenation of sorted parameters + session key + application secret. Miss the sort — signature is invalid, response invalid_session. The mobile app interacts with the bot through an intermediary server: client sends message → server receives webhook from OK → processes logic → responds via messages.send. Storing application_secret_key on the device is not allowed.
What Actually Needs to Be Implemented
Authorization via OK OAuth. If the bot acts on behalf of a user (not a group), an access_token with MESSAGES rights is needed. The OK mobile SDK for Android (one-sdk-android) simplifies the OAuth flow, but for custom UX you'll have to use a WebView with redirect URI interception.
OK mailings to group subscribers. notifications.sendSimple only works if the user has interacted with the group. Attempting to send without prior contact → user_not_invited_to_group. This is a platform limitation that cannot be bypassed.
Auto-replies in Odnoklassniki. The bot monitors GROUP_MESSAGE_NEW via Long Polling or Callback API. Callback API is more reliable — Long Polling requires keeping a constant connection, which is not optimal on a mobile server.
Long Polling vs Callback API: Which to Choose?
| Criterion |
Long Polling |
Callback API |
| Constant connection |
Yes |
No |
| Delivery latency |
Medium |
Low |
| Server load |
High |
Low |
| Reliability |
Medium |
High |
| Recommendation |
For prototypes |
For production |
Why Errors Occur During Chat Bot Development?
Typical errors and their solutions
| Error |
Cause |
Solution |
| Incorrect parameter sorting |
Forgetting native key sorting |
Always sort parameters lexicographically |
| Storing secret on client |
Simplifying debugging |
Keep application_secret_key on the server |
| Ignoring OK limitations |
Not knowing notifications.sendSimple behavior |
Check group interaction beforehand |
| Lack of error handling |
Not checking response codes |
Handle all error codes from OK API documentation |
Professional Chat Bot Development: Results and Guarantees
5 years of experience and 20+ projects allow us to avoid the described errors. All bots undergo load testing at 20,000 messages per day. We provide architectural documentation, source code, deployment instructions, and 3 months of free support. Your development budget will be reduced by 30% through the use of ready-made signing and OAuth modules. Get a consultation — we will evaluate your project.
What Is Included in the Chat Bot Work?
- Scenario analysis and interface prototyping.
- Application registration in OK Dev Center, group rights configuration, and webhook endpoint setup.
- Server-side development in Python (FastAPI) or Go with signature support, event routing, and dialog storage in a database.
- Mobile client: chat UI (RecyclerView + DiffUtil for Android, UICollectionView with compositional layout for iOS), integration with your API, push notifications via FCM/APNs.
- OK API integration with CRM (via REST API or webhook), configuring notifications about new dialogs.
- Load testing (20,000 messages per day) and optimization.
- Full documentation: architecture, API contracts, deployment instructions.
- 3 months of free support and revisions.
Process of Work
- Analysis — discuss bot scenarios, target audience, integrations.
- Application registration — in OK Dev Center, group rights configuration, webhook endpoint.
- Server side — develop signature handler, event routing, dialog storage in database.
- Mobile client — chat UI (RecyclerView + DiffUtil for Android, UICollectionView with compositional layout for iOS), integration with your API.
- Testing — on real OK accounts, also via TestFlight and Firebase App Distribution.
- Deployment — deploy server on your cloud, configure CI/CD.
Timeline Estimates
Basic bot with auto-replies in a group and mobile interface — 3–5 days. If mailings, dialog analytics, CRM integration are needed — 2–3 weeks. Exact timelines are calculated individually.
Contact us to get a preliminary cost and timeline estimate. Request a consultation — we will analyze your scenario and propose an optimal solution.
Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models
We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.
How to Choose Between CoreML and TFLite for On-Device Inference?
CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.
TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.
For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.
| Parameter |
CoreML |
TFLite |
| Platforms |
iOS, macOS, watchOS |
Android, iOS, Linux, embedded |
| Hardware acceleration |
Neural Engine, GPU, CPU |
NNAPI, GPU (OpenCL/OpenGL), CPU |
| Quantization support |
FP16, INT8 (with coremltools) |
FP16, INT8, dynamic range |
| Custom operations |
Via MLCustomLayer (Swift) |
Via delegates (Java/Kotlin) |
| Model bundle size |
~3–5 MB (MobileNetV2 quantized) |
~2–4 MB |
What If You Need Text Generation On-Device?
Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.
llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.
On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.
Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.
How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?
On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.
| Criteria |
On-Device Inference |
Cloud API |
| Latency |
<50ms |
200–500ms (including network) |
| Cost per 1M requests |
$0 (no server) |
$10–50 (AWS Rekognition, Google Vision) |
| Privacy |
Data stays on device |
Data sent to server |
| Offline |
Yes |
No |
| Scalability |
No server scaling issues |
Need to provision API capacity |
For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.
Integrating OpenAI API and Other Cloud Models
For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.
Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.
What Is Included in the Work (Deliverables)
- Trained and quantized model for the target device (documentation with metrics)
- SDK for integration (Swift/Kotlin/Flutter) with call examples
- Performance tests on 3–5 real devices
- Instructions for OTA model updates
- Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
- 2 weeks of technical support after release
Typical Project Pipeline
-
Task analysis — measure latency, privacy, size, supported devices.
-
Model prototyping — in Python, evaluate accuracy on target data.
-
Conversion and quantization — for CoreML/TFLite with validation.
-
Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
-
Testing — on real devices, measure FPS, RAM, battery.
-
Deployment — via TestFlight / Firebase App Distribution, monitor metrics.
Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.
Why We Take on Complex Cases?
10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.
Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.
