web/miniapp.json

The app's identity and permissions. It ships inside the bundle; the simulator reads it from a dev server or an imported zip; minikit package derives the host's catalog entry from it.

{
  "$schema": "../.minikit/schemas/miniapp.schema.json",
  "schemaVersion": 2,
  "id": "expense-tracker",
  "name": "Expense Tracker",
  "version": "1.0.0",
  "entryPoint": "index.html",
  "offline": true,
  "authType": "none",
  "permissions": ["auth", "storage", "files"],
  "legacyCapabilities": [],
  "metadata": {"originalHost": "api.example.aramco.com.sa"}
}

Field	Rule
`schemaVersion`	`2` for new apps. `1` is Studio's format and still loads.
`id`	lower-case letters, digits, `.`, `_`, `-`; ≤ 64 characters. It becomes a folder and a port on the host: permanent once shipped.
`name`	non-empty display name
`version`	`1.2.0` style
`entryPoint`	relative `.html` inside the bundle, default `index.html`
`offline`	runs without sign-in; when absent, `authType: none` means offline
`authType`	`none`, `sso` or `adfs`; must agree with `offline`
`permissions`	framework permissions: `auth`, `storage`, `files`, `share`. A host's own namespace is accepted with a warning.
`legacyCapabilities`	only for migrated apps that still call `window.features`: `makePhoneCall makeZoomCall sendEmail openMaps openInAppBrowser share sharePDF shareToMetabrain downloadPDF pickFile pickImage getUserData`
`metadata`	host hints, not identity (`originalHost` for API routing)

minikit validate checks the file (codes MK10xx) and compares permissions with what the code calls: an sdk.files.* call without files declared is an error, because the host will refuse it at runtime.

Migrating a Studio manifest

Schema 1 lists legacy capabilities under permissions. Set schemaVersion to 2, move those names to legacyCapabilities, and put the framework permissions under permissions (getUserData → auth; pickFile/pickImage/downloadPDF → files; share* → share; storage for local data).