Viber Chatbot Development: Registration, Webhook, Rich Media & Deployment

Viber Chatbot Development: Registration, Webhook, Rich Media & Deployment

Many teams confuse Viber Public Account and Bot API when starting automation, picking the wrong account type. They waste time on bureaucracy or hit Bot API limitations despite Rich Media and Keyboard capabilities. Choosing correctly from the start saves up to 2 weeks of development.

Another frequent issue is a webhook without signature validation. Without HMAC verification, an attacker can send a forged message on behalf of a user. We always implement X-Viber-Content-Signature verification to eliminate this attack vector entirely.

Why Viber Bot API Is Better for Automation

Viber Bot API is registered via developers.viber.com for free, no contract or moderation required. You get an auth_token within minutes and can immediately set the webhook. Unlike Public Account, there are no strict content requirements — you decide what messages to send.

Key differences:

How to Set Up Webhook and Ensure Security

Creating a bot is done through the Viber Admin Panel. After creation, an auth_token is issued — used in every API request in the X-Viber-Auth-Token header. The webhook is set via a single POST request:

import requests

def set_webhook(url: str, auth_token: str):
    response = requests.post(
        "https://chatapi.viber.com/pa/set_webhook",
        headers={"X-Viber-Auth-Token": auth_token},
        json={
            "url": url,
            "event_types": [
                "delivered", "seen", "failed",
                "subscribed", "unsubscribed",
                "conversation_started", "message"
            ],
            "send_name": True,
            "send_photo": True
        }
    )
    return response.json()  # {"status": 0, "status_message": "ok"}

Viber confirms the webhook immediately in the response to set_webhook — no separate verification challenge like in WhatsApp/Meta. This simplifies integration.

Webhook Security

Webhook security is achieved by verifying the signature of each incoming request. Viber sends the header X-Viber-Content-Signature, which contains HMAC-SHA256 of the request body with the auth_token as the key.

import hmac, hashlib

def verify_viber_signature(body: bytes, signature: str, auth_token: str) -> bool:
    expected = hmac.new(
        auth_token.encode(),
        body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Without this check, your webhook can accept fake messages from third parties. We implement signature verification at the middleware level in all projects.

Common Webhook Setup Mistakes

• Using HTTP instead of HTTPS — Viber rejects insecure URLs.
• Ignoring X-Viber-Content-Signature — the bot becomes vulnerable.
• Wrong auth_token — ensure the token is from the Admin Panel, not from a Public Account.
• Missing conversation_started handling — the bot cannot greet new users.
• Mass messaging to non-subscribers — Viber blocks the account.

What Message Types Does Viber Support?

Viber supports: text, picture, video, file, sticker, contact, url, location, and rich_media. Rich Media is a custom carousel format with buttons, images, and titles. Rich Media is specific to Viber — no direct analog in Telegram. Ideal for product catalogs, news, and service cards.

Example of sending Rich Media:

def send_rich_media(receiver: str, auth_token: str, items: list):
    rich_media = {
        "Type": "rich_media",
        "ButtonsGroupColumns": 6,
        "ButtonsGroupRows": 7,
        "BgColor": "#FFFFFF",
        "Buttons": []
    }

    for item in items:
        rich_media["Buttons"].extend([
            {
                "Columns": 6, "Rows": 3,
                "ActionType": "open-url",
                "ActionBody": item["url"],
                "Image": item["image_url"]
            },
            {
                "Columns": 6, "Rows": 1,
                "Text": f"<b>{item['title']}</b>",
                "ActionType": "none"
            },
            {
                "Columns": 3, "Rows": 1,
                "Text": "Learn more",
                "ActionType": "open-url",
                "ActionBody": item["url"],
                "BgColor": "#2db5f5"
            }
        ])

    requests.post(
        "https://chatapi.viber.com/pa/send_message",
        headers={"X-Viber-Auth-Token": auth_token},
        json={"receiver": receiver, "type": "rich_media", "rich_media": rich_media}
    )

Keyboard and One-Time Buttons

Viber Keyboard is a custom keyboard at the bottom of the screen. min_api_version: 1 for basic buttons:

keyboard = {
    "Type": "keyboard",
    "DefaultHeight": True,
    "BgColor": "#FFFFFF",
    "Buttons": [
        {
            "Columns": 3, "Rows": 1,
            "Text": "Catalog",
            "ActionType": "reply",
            "ActionBody": "catalog",
            "BgColor": "#f5f5f5"
        },
        {
            "Columns": 3, "Rows": 1,
            "Text": "Support",
            "ActionType": "reply",
            "ActionBody": "support",
            "BgColor": "#f5f5f5"
        }
    ]
}

The keyboard is sent with each message — it does not "stick" like in Telegram. Standard pattern: attach a keyboard to every bot response.

conversation_started Event

conversation_started — the user opens the chat with the bot for the first time or via a deep link. This is the only moment when you can send a welcome message to an unsubscribed user. After that, the user must write (subscribe) before the bot can send messages.

Limitation: Viber does not allow mass messaging to unsubscribed users — only to those who have subscribed (event subscribed).

Error Handling and Retries

When sending messages, Viber returns a failed status in the webhook. It is crucial to set up retry logic with exponential backoff. We use Redis to store the message queue and retry sending up to 3 times with delays of 5, 30, and 120 seconds. This boosts deliverability to 99.8%.

What's Included in Viber Bot Development

When ordering turnkey Viber bot development, you get:

• Registration and bot setup in Viber Admin Panel
• Webhook installation with signature verification
• Handling of all events (message, conversation_started, subscribed, unsubscribed)
• Rich Media / Keyboard implementation according to your design
• Dialog scenarios with state management (Redis FSM)
• Integration with your CRM or backend systems
• Bot API documentation and access credentials
• Post-launch support (2 weeks free)

We have been developing mobile solutions for over 6 years — we have completed more than 30 projects on Viber, Telegram, and WhatsApp. Our engineers are certified in Swift and Kotlin, ensuring high code quality. Every bot undergoes load testing before release. We provide a 3-month warranty on bot operation after launch.

"On Viber, we built a catalog bot with Rich Media — conversion to purchase increased by 25% in the first week" — client feedback.

Timeline Estimates

Cost is calculated individually based on complexity and integrations. Contact us — we'll evaluate your project within 1 business day. Reach out for a consultation on your project.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.