V1.2 REST API

// Express proxy. AKEDLY_API_KEY and AKEDLY_PIPELINE_ID live in env — never
// ship them to the client.
import express from 'express';

const app = express();
app.use(express.json());
// Required — every send carries the real end user's IP in x-end-user-ip.
// Keep this line and the header below.
// Makes req.ip the real end user's IP behind a reverse proxy (1 = trust first hop).
app.set('trust proxy', 1);

app.get('/auth/akedly/challenge', async (_req, res) => {
  const r = await fetch(
    `https://api.akedly.io/api/v1.2/transactions/challenge` +
    `?APIKey=${process.env.AKEDLY_API_KEY}` +
    `&pipelineID=${process.env.AKEDLY_PIPELINE_ID}`
  );
  res.status(r.status).json(await r.json());
});

app.post('/auth/akedly/send', async (req, res) => {
  const { phoneNumber, email, powSolution, turnstileToken } = req.body;
  const r = await fetch('https://api.akedly.io/api/v1.2/transactions/send', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-end-user-ip': req.ip,
    },
    body: JSON.stringify({
      APIKey: process.env.AKEDLY_API_KEY,
      pipelineID: process.env.AKEDLY_PIPELINE_ID,
      verificationAddress: { phoneNumber, email },
      ...(powSolution ? { powSolution } : {}),
      ...(turnstileToken ? { turnstileToken } : {}),
    }),
  });
  res.status(r.status).json(await r.json());
});

app.post('/auth/akedly/verify', async (req, res) => {
  const { transactionReqID, otp } = req.body;
  const r = await fetch('https://api.akedly.io/api/v1.2/transactions/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ transactionReqID, otp }),
  });
  res.status(r.status).json(await r.json());
});

import { solvePow, getTurnstileToken } from '@akedly/shield';

// Step 1: Get challenge from YOUR backend (never call Akedly directly)
const challengeRes = await fetch('/auth/akedly/challenge');
const { data } = await challengeRes.json();

// Step 2: Solve PoW — ONLY when the pipeline asks for it. When PoW is off (or
// dev mode bypasses it) the response carries no challenge/difficulty at all.
let powSolution;
if (data.challengeRequired) {
  const { nonce } = await solvePow(data.challenge, data.difficulty);
  powSolution = { challengeToken: data.challengeToken, nonce };
}
let turnstileToken;
if (data.turnstile?.required) {
  turnstileToken = await getTurnstileToken(data.turnstile.siteKey);
}

// Step 3: Send OTP via YOUR backend
const sendRes = await fetch('/auth/akedly/send', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    phoneNumber: '+201234567890',
    ...(powSolution ? { powSolution } : {}),
    ...(turnstileToken ? { turnstileToken } : {}),
  }),
});
const { data: txData } = await sendRes.json();

// Step 4: Verify OTP via YOUR backend. The input may be 4, 5 or 6 digits —
// read the length from your pipeline config, never hardcode it in the UI.
const userEnteredOtp = document.querySelector('#otp').value;
await fetch('/auth/akedly/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ transactionReqID: txData.transactionReqID, otp: userEnteredOtp }),
});