Skip to content

Requirements — hosting, security, UX, content, review

1. Hosting

  • HTTPS (TLS 1.2+, a valid certificate), HSTS RECOMMENDED. The origin has a public IP (the platform does not connect to internal addresses for manifests or webhooks). For maintenance, switch the app to maintenance in the console.
  • /.well-known/gerege-miniapp.json (or openpay-miniapp.json) — manifest.md, no redirects.
  • Web host (iframe) «coming soon» — a Content-Security-Policy: frame-ancestors requirement will be added then. Setting X-Frame-Options today has no effect in the iOS WebView.
  • Performance (4G, a mid-range phone): first screen (ready) ≤ 2.5 s, initial-load JS ≤ 300 KB gzip, images WebP/AVIF, lazy-loaded.
  • Supported: iOS 17+ WebKit. (Android WebView — when the Android host ships.)

2. Security

  • Client secret, access/refresh tokens, webhook secret — on the backend only. FORBIDDEN in the frontend bundle, logs, analytics or URLs.
  • Remove the launch parameter from the URL immediately; Referrer-Policy: strict-origin-when-cross-origin or stricter.
  • People sign in only through the Gerege launch (your own password/OTP forms are FORBIDDEN).
  • Payments only through payments.md; verify webhook signatures (webhooks.md).
  • OWASP ASVS L1 as the minimum: XSS (a strict CSP script-src), CSRF (if you use cookies), input validation, dependency scanning.
  • Personal data: Mongolia's Law on the Protection of Personal Information; only data obtained through scopes, and only for its purpose; deletion requests within 30 days. Do not send sub / user_ref to third-party analytics.
  • Report a security incident to the operator within 24 hours.

3. UX and design

  • Mobile-first, 320–430 px wide. Horizontal scrolling is FORBIDDEN.
  • Follow getContext().theme (light/dark) and safe_area. The host header (title, close) is already there — do not build a second "back/close" header; a back button for internal navigation is fine.
  • Language: Mongolian required; English RECOMMENDED when locale is something else. Money as 45,000₮ (integer), dates in Asia/Ulaanbaatar.
  • Touch targets ≥ 44×44 pt, body text ≥ 15 pt, WCAG AA contrast.
  • Loading: skeletons; every error gets a clear Mongolian message + retry.
  • You may use your accent_color on the primary button. Using Gerege's logo/name as if it were your own brand is FORBIDDEN.
  • «Удахгүй» ("coming soon") buttons, buttons that do nothing, and empty placeholder screens are FORBIDDEN (inside the mini app).

4. Content and business

  • Mongolian law, App Store / Google Play policies. Forbidden: unlicensed gambling, illegal goods, 18+ content for minors, misleading advertising.
  • Show prices, terms and the refund policy clearly before payment.
  • Digital content consumed inside the app on iOS (subscriptions, game entitlements) requires IAP under Apple's policy; through the wallet, sell only goods/services consumed outside the app (eSIM, tickets, food).
  • The support channel (legal.support_url) answers within 24 hours on working days. E-barimt is the developer's responsibility (linked through the intent's reference).

5. Review checklist

# What is checked
1 Manifest schema, verification, origins, icon 512, legal URLs
2 Launch: ready ≤ 2.5 s, light/dark, safe area, 320 px
3 Session: launch → backend exchange; no token/secret in the frontend (bundle + network inspected)
4 Payment: amount from the backend, intent → requestPayment → deliver after the webhook/GET check; no double delivery
5 Refund/cancel flow; for manual, capture/cancel is decided within 7 days
6 Webhook signatures, replay, dedupe
7 openExternal only for declared URLs; no other sign-in/payment forms
8 Mongolian text, error messages
9 Personal data: nothing asked beyond the scopes, a privacy policy
10 Special categories (games/finance) — licence documents

Automatic requirements for submit: a checked manifest, privacy/terms/support links, a live client secret, and a webhook URL if the app has the payments scope. The manifest check fetches the 512 icon (PNG, exactly 512×512) and requires the three legal pages to answer 200 without redirects. For a service meant for 18+ or verified people, declare min_age / requires_verified in the manifest — the platform enforces them at launch itself (auth.md §1.1). Before review, check all your flows with test users, test payments and webhook.test (console.md).