An Account Area in a Telegram Bot: Mini Apps

A Mini App is the answer to buttons no longer being enough. Worth knowing up front: it is not a bot feature but a separate web application, and the effort matches.

What it is

A web page that opens inside the messenger over the chat. An ordinary frontend with its own hosting, plus one important addition: the platform passes it data about the user who opened it.

The practical consequence: building a Mini App is frontend development. Layout, state, requests to your backend, testing across devices. The bot remains: it provides the button that opens the app and continues handling notifications.

When it is needed and when it is not

Buttons suffice for:

• A linear scenario: a few questions and a result.
• A short menu two or three levels deep.
• Notifications with a yes/no action.
• A catalogue of a dozen items.

A Mini App is needed for:

• Tables and lists with filters and sorting.
• Forms with many fields, where one question at a time is tiring.
• A large catalogue with search.
• Charts and reports.
• Anything where the user must see a lot of data at once.

The practical marker: the menu has grown to a fourth level of nesting. The interface has outgrown buttons - see buttons.

The reverse marker: a Mini App for a single three-field form is wasted work. Three questions in a conversation are answered faster than a page loads.

Authentication

This is where mistakes are most common, and they are serious.

The platform passes user data to the app together with a signature. The signature must be verified, and verified on the server.

Without verification: the data comes from the client and can therefore be forged. An app that takes it at face value lets anyone claim to be anyone and read somebody else’s data.

The correct flow:

1. The app opens and receives data from the platform.
2. It sends that data to your server.
3. The server verifies the signature with a key derived from the bot token.
4. Only then does the server issue a session and return data.

The bot token stays on the server and never reaches the app - see the token.

What to plan for

• Hosting and HTTPS. A real domain with a certificate; a local address will not do.
• Mobile first. Most users open it on a phone, and space is tight.
• Dark and light themes. The app opens inside the messenger, and an interface ignoring the user theme looks alien.
• Load speed. Users expect chat-like responsiveness rather than website-like. A heavy page is out of place.
• Working without the app. Some flows should stay available through the bot: not everyone will open a Mini App.
• Data on the server. The app displays; the backend decides.

The scope of such a project is a bot plus a frontend plus a backend, and it should be estimated accordingly: bot development.

How to deploy and operate all of it: deployment. The overview is in the Telegram bots guide.