Establish identity on the server
Validate raw initData on the backend using the official procedure; initDataUnsafe is not trusted authentication evidence. Check authentication age and apply a replay policy. Keep the bot token out of frontend assets.
Launch paths carry different context
Main apps, menus, direct links and attachment entries differ. Client implementers open WebViews and bridge events; Mini App developers use the JavaScript API. The two references address different layers. Attachment availability and installation confirmation depend on current capabilities, not merely on having a bot.
Adapt to real devices
Themes, safe areas, content safe areas, viewports and keyboards affect usable space. Detect support and provide fallbacks for older clients. A fixed browser height does not describe every rotation or keyboard state.
Track referral programs separately
Commissions, durations, termination and attribution have distinct rules. Ending a program does not necessarily end previously established commission periods. Read current state before sharing links or reporting revenue.