When abdm is calling the registered callbacks, is there any way to authenticate wether abdm is making that call?

[Phaneendhar123]

@IntegrationSupport, When abdm is calling the registered callbacks, is there any way to authenticate wether abdm is making that call??

is there any way that abdm sends the api-key or the token that we can authenticate ???

can you help us here ???

[ayadav]

This should help

Best Practice to validate Authorization token

Hi @tuntunia, You have to validate the token coming in Authorization header. You can use Gateway Certs to validate the JWT token.

[Phaneendhar123]

@ayadav
i’m asking about the callbacks that ABDM calls to our service
ex: let’s taken example from the HIP initiated linking

1. v0.5/users/auth/on-fetch-modes
2. /v0.5/users/auth/on-init
3. /v0.5/users/auth/on-confirm
4. /v0.5/links/link/on-add-contexts

these are the callbacks that abdm calls, so in order to verify wether abdm is calling these callbacks or someone else is calling these, how do i know ??

[ayadav]

@Phaneendhar123
Yes, the link I sent is for the same.You should verify the JWT auth token sent by ABDM in header against the gateway certs.
You could see this reference in python.

dimagi/abdm-python-integrator/blob/main/abdm_integrator/utils.py#L206