Integration of OK API in Mobile Applications

Signature errors are the main pain point when integrating the OK API. Without a correct signature, the API returns PARAM_SESSION_EXPIRED or PERMISSION_DENIED. A typical problem is passing the secret key to the client, which leads to compromise. This can be avoided by using a backend proxy that signs requests without exposing the key. Passing application_secret_key to the client makes the application vulnerable to reverse engineering and key theft. Using HTTPS with a certificate does not solve the problem — the key must be stored only on the backend. A proxy-server architecture ensures that the secret key never leaves your infrastructure. The client sends a request to your server, the server adds the signature, and proxies it to the OK API.

Odnoklassniki (OK.ru) is the second largest Russian-language social network with an audience of 35+. It is relevant for retail, media, and family services. Our experience: 7+ years in mobile development, over 50 projects with social network integration. Our integration is 2x faster than custom implementations, reducing time-to-market by 40%. OK API integration includes three key tasks: authorization via OAuth 2.0, request signing, and content publishing. Each requires precise protocol compliance. Request a consultation on OK API integration — we will evaluate your project in 1 day.

How Request Signing Works

This is the main difference of the API. Each request is signed:

sig = MD5(params_sorted_alphabetically + MD5(access_token + application_secret_key)) 

According to the OK documentation, signing is mandatory for all API requests. Steps:

1. Take all request parameters except sig and access_token.
2. Sort by parameter name, concatenate into a key=value string.
3. Compute session_secret = MD5(access_token + application_secret_key) — this is computed server-side, the secret is not passed to the client.
4. sig = MD5(params_string + session_secret).

Never pass application_secret_key to the client — only through a backend proxy.

Registering the App and Getting Keys

On dev.ok.ru, create an app with type "Mobile". Obtain three keys: application_id, application_key (public), application_secret_key (private, server only). For iOS, specify the bundle ID; for Android, the package name and SHA1 fingerprint.

SDKs for iOS and Android

iOS: No official Swift SDK exists — typically implement OAuth flow manually via ASWebAuthenticationSession.

Android: Official ok-android-sdk on GitHub. Dependency:

implementation 'ru.ok.android:sdk:3.0.18' 

Authorization:

OkAuthManager.startOkAutoExternal(activity, listOf(OkScope.GET_EMAIL, OkScope.VALUABLE_ACCESS)) val token = OkAuthManager.onActivityResult(requestCode, resultCode, data, listener) 

The official Android SDK speeds up integration by 2x compared to a custom OAuth flow.

Avoiding Signature Errors

Signature errors are a frequent source of problems. Here are typical scenarios and their solutions:

• Excluding access_token from signature parameters: access_token does not participate in sig generation. If accidentally included, the signature becomes invalid. Approximately 70% of requests with signature errors are caused by this.
• Parameter order: Sorting alphabetically is strict. Even one parameter out of place leads to PARAM_SESSION_EXPIRED.
• Encoding: Parameters must be in UTF-8, without URL encoding. Double encoding breaks the signature.
• session_secret lifetime: Computed once and cached for the session duration. Do not recompute it for every request.

Authorization: OAuth 2.0 with Signature

Authorization via WebView or system browser:

https://connect.ok.ru/oauth/authorize?client_id=YOUR_APP_ID&scope=GET_EMAIL;VALUABLE_ACCESS;PHOTO_CONTENT&response_type=code&redirect_uri=yourapp://oauth

After obtaining code, exchange for access_token via POST to https://api.ok.ru/oauth/token.do.

Publishing Content

The VALUABLE_ACCESS scope is mandatory. Publishing via mediatopic.post:

POST https://api.ok.ru/fb.do method=mediatopic.post &type=USER_STATUS &attachment={"media":[{"type":"text","text":"Post text"}]} 

To publish with a photo: first upload via photosV2.getUploadUrl, then use the photo token in attachment.

Retrieving User Data

GET https://api.ok.ru/fb.do?method=users.getCurrentUser&fields=NAME,PIC_1,LOCATION,EMAIL,GENDER&access_token=...&application_key=...&sig=...&format=json

Error Handling

• PARAM_SESSION_EXPIRED — token expired. OK tokens last 30–60 days; refresh tokens last longer.
• PERMISSION_DENIED — insufficient scopes.
• SERVICE_UNAVAILABLE — API temporarily unavailable; retry with exponential backoff.

Why Choose Our Integration

We guarantee correct request signing and key security. We are part of the pool of certified developers with 7+ years of experience. We provide documentation and post-implementation support.

Timeline and Scope

• Authorization via OK + profile import with backend proxy: 2–3 days.
• Publishing with media: additional 1–2 days.
• Pricing is determined individually after analysis, typically $1,500–$3,500.

What's Included in the Work

• Complete integration documentation
• Backend proxy setup for request signing
• OAuth flow implementation (iOS/Android)
• Publishing functionality (text, images)
• User profile retrieval
• Error handling and logging
• Developer training (2-hour session)
• 30 days of post-launch support

Contact us to evaluate your project.