Frontend rule: read initData (the raw signed string) and send it to your backend for verification. initDataUnsafe is for UI display only and is never proof of identity.

Overview

Choose an entry point

After an enabled MiniApp opens inside MPChat, the browser SDK exposes its launch data.

A direct link uses https://mp.net/{botUsername}/{shortName} and can carry ?startapp=.
A sendMessage inline web_app button normally opens the bot's enabled MiniApp in private chat. For this MiniApp share in a group or supergroup the bot has joined, the keyboard must contain exactly one row and one button. That button may contain only text and web_app.
A Reply Keyboard web_app button is for private chats. The chat menu is configured separately with setChatMenuButton and accepts a valid HTTPS URL up to 2048 characters. An external menu URL may not have MiniApp launch data.

Send a single inline entry button

Use the bot's registered entryUrl or its full MPChat direct link. The request uses web_app.url to identify the MiniApp. The JSON below also has the required button shape for a group the bot has joined.

{
  "chat_id": "987654321",
  "text": "Open Demo MiniApp",
  "reply_markup": {
    "inline_keyboard": [[
      { "text": "Open", "web_app": { "url": "https://mp.net/MyBot/demo" } }
    ]]
  }
}

Load the browser SDK

This script runs in the MiniApp page. The Node.js Bot SDK runs on your server and is a separate package. Keep the bot token on that server.

<script src="https://mp.net/i/mpchat-web-app.js"></script>

const initData = window.MpChat.WebApp.initData;            // signed string -> backend
const initDataUnsafe = window.MpChat.WebApp.initDataUnsafe; // UI only, untrusted

initData vs initDataUnsafe

Value	Use for authorization?
initData (raw signed string)	Yes — after backend verification.
initDataUnsafe (parsed object)	No — UI display only.

Field support (current phase)

Signed launch data: initData uses keys such as query_id, auth_date, chat_type, and start_param. The parsed initDataUnsafe may expose camelCase fields such as queryId, authDate, chatType, and startParam for display.
Partially supported: the initDataUnsafe object structure and user/chat subsets.
Not supported yet: runtime metadata, view state, native UI controls (BackButton/MainButton), storage/device APIs, and methods like sendData, openLink, popups, QR — do not rely on MiniApp→Bot sendData / web_app_data return flows. Message-button callbacks are a separate, supported path.

Security must-dos

Never put the bot token in frontend code, WebView storage, URLs, logs, or analytics.
Send the raw initData to the backend and verify before trusting any field.

Only call native methods via window.MpChat.WebApp.call(name, params) when your MPChat client version explicitly announces support.

MiniApp frontend integration: entry points, SDK, and initialization data