1.8 KiB
OTP Webhook example
This command implements the telesrv OTP Webhook v1 receiving side with only
the Go standard library. It validates the signed request, rejects expired or
invalid payloads, and deduplicates concurrent or repeated delivery IDs.
The default exampleDelivery function deliberately does not send a real
email/SMS and does not print the code or recipient. For local debugging only,
set TELESRV_OTP_EXAMPLE_LOG_CODE=true to print the received code while still
redacting the recipient. Replace that one function with the API call for your
email or SMS provider before real use.
Run
$env:TELESRV_OTP_EXAMPLE_SECRET = 'replace-with-a-random-secret'
$env:TELESRV_OTP_EXAMPLE_LOG_CODE = 'true' # local testing only
go run ./cmd/otpwebhook-example
The default endpoints are:
POST http://127.0.0.1:2800/v1/otp/deliveriesGET http://127.0.0.1:2800/healthz
Then configure telesrv with the same secret:
TELESRV_EMAIL_CODE_DELIVERY_PROVIDER=webhook
TELESRV_PHONE_CODE_DELIVERY_PROVIDER=webhook
TELESRV_OTP_WEBHOOK_URL=http://127.0.0.1:2800/v1/otp/deliveries
TELESRV_OTP_WEBHOOK_SECRET=replace-with-a-random-secret
The example accepts these optional settings:
TELESRV_OTP_EXAMPLE_ADDR=127.0.0.1:2800
TELESRV_OTP_EXAMPLE_MAX_SKEW=5m
TELESRV_OTP_EXAMPLE_LOG_CODE=false
The idempotency registry is intentionally in memory. A production receiver must put delivery IDs and the downstream provider message ID in durable shared storage before running more than one instance or surviving restarts. Pass the same delivery ID to a downstream provider when it supports idempotency. The example remembers both successful and failed outcomes until the code expires, because an apparent downstream failure may have happened after it sent the message.