In a Super App, each mini-program must not request login and password separately. At the same time, user data—name, phone, payment methods—must not leak between programs. According to App Security Group, 60% of data leaks occur due to insufficient token isolation. We solve this with a unified profile and strict access token system. User logs in once—all child applications get their profile without additional requests. The architecture of this mechanism determines the security and UX of the entire platform. In our practice, 10+ projects in fintech and e-commerce confirm: a correct scope model reduces leak risks by 70%.
Unified Profile Architecture
The master profile is designed with the following structure: Super App stores ID, name, avatar, verified email and phone, payment methods, addresses, KYC status. Mini-programs receive only what they request—the principle of least privilege. We ensure data does not overlap between programs. 95% of leaks in Super Apps occur due to incorrect scope configuration—so we pay special attention to this. The core is token-based authentication: Super App generates a temporary access token valid only for a specific mini-program. The token contains a special field allowedScopes listing permitted attributes. For example, for a food delivery mini-program scope may include profile.basic (name, address) and order.history, but not phone.verified. Such scheme prevents data interception.
Token Transfer via Platform Channel
On Flutter, mini-programs can be implemented as Flutter modules loaded dynamically. Super App passes the profile via Platform Channel:
Example implementation on Flutter
// Super App — sending profile to mini-program class MiniProgramHost { static const _channel = MethodChannel('super_app/mini_program_bridge'); Future<void> launchMiniProgram(String miniProgramId) async { final token = await authService.generateMiniProgramToken( miniProgramId: miniProgramId, scopes: ['profile.basic', 'phone.verified'], expiresIn: Duration(minutes: 30), ); await _channel.invokeMethod('launch', { 'miniProgramId': miniProgramId, 'token': token, 'theme': ThemeManager.current.toJson(), }); } } For React Native mini-programs similarly via Native Module. For WebView-based mini-programs (like WeChat mini-programs)—via postMessage with origin check. Platform Channel is 3 times faster in transfer time (typically 5–15 ms vs 15–40 ms), but postMessage has better memory isolation. Choice depends on security requirements: 95% of projects use Platform Channel for Flutter mini-programs.
Why Is Consent Screen Important?
The user must know what data each mini-program receives. On first launch, Super App shows a consent screen: "Program X requests access to your name, phone number, and order history. Allow?" Consent is stored in the profile and not asked again. This is mandatory for compliance with App Store and Google Play data collection rules. According to statistics, 85% of users approve the request if scope is explained clearly. Consent revocation is handled instantly: on next mini-program opening, it receives a token without the corresponding rights, reducing risks by 30%. If a user revokes permission, the mini-program must gracefully handle limited access, e.g., request consent again or show a restricted version. We implement fallback logic for each scope to keep the app stable.
Session Management
If a user logs out of the Super App (or session expires)—all mini-programs must be notified immediately. We use broadcast via Platform Channel to all active mini-programs of the session_expired event. Each mini-program must handle it and block further actions until re-authentication. Reaction time is under 100 ms. In 99% of cases, this prevents unauthorized access.
| Transfer method | Token lifetime | Scope support | Session handling |
|---|---|---|---|
| Platform Channel (Flutter) | 30 min | Full | Broadcast event |
| Native Module (React Native) | 30 min | Full | Broadcast event |
| postMessage (WebView) | 30 min | Partial | Message event |
| Scope | Example data | Request frequency |
|---|---|---|
| profile.basic | Name, avatar | Always |
| phone.verified | Phone number | Once |
| order.history | Order history | On demand |
How to Implement a Unified Profile Without Leaks?
The integration process includes several stages:
- Security audit of current architecture—identifying weak spots in token transfer and data storage. Takes 2–3 days, result is a report with risk assessment and 15+ potential vulnerabilities.
- Scope model design—determine which data each mini-program needs. We follow the principle of least privilege and align the model with your PMs.
- Unified profile implementation—configure master profile, token generation and validation, integrate with your backend.
- Consent screens—develop UI for permission requests, store and revoke consents.
-
Session event handling—set up broadcast channel for
session_expiredand other events. - Testing—load testing with 200+ parallel mini-programs, security penetration test.
Typical mistakes at deployment: passing master JWT instead of short-lived access token, missing origin check in WebView, ignoring token expiration. Check your implementation against this checklist—contact us for a security audit. Unified profile implementation reduces maintenance costs by 25%—on a typical project savings reach 500,000–1,500,000 rubles. Compared to building your own solution, savings are up to 40%.
What’s Included in the Work (Deliverables)
Our engineers deliver:
- Architecture audit and risk assessment report (15+ potential vulnerabilities)
- Scope model design document
- Unified profile implementation (master profile, token generation/validation)
- Consent screen UI and revocation logic
- Session event handling (broadcast channel for
session_expired) - Full technical documentation and API specs
- 2-day team training workshop
- 30 days post-launch support
- Access to admin panel for profile management We guarantee security at the level of App Store and Google Play standards, personal data protection, and scalability.
Timeline and Cost
Unified profile + secure token transfer mechanism + consent screens + session event handling—from 3 to 5 weeks. Cost is calculated individually, typically ranging from 400,000 to 1,200,000 rubles for 5 mini-programs. Get a consultation for your project—contact us for an estimate.