Instructions for Third-Party Application Admins

Handling Token Verification Requests

Your application will receive GET requests with a token and email for verification. Here's how to handle them:

1. Endpoint Structure

Set up your application to handle GET requests to the /landing endpoint.

Example URL: http://211.113.9.38:88/landing?token=7f302890c97f19f936dba696df912b6f51b64a1e606b7d77fa5544a4e9121677&email=%22firstname.lastname%40gmail.com%22

2. Parsing the URL

Extract two query parameters:

token: The verification token
email: The customer's email (URL-encoded)

3. Decoding the Email

The email is URL-encoded and wrapped in quotes. Decode it like this:

javascript const decodedEmail = decodeURIComponent(email).replace(/^"(.*)"$/, '$1');

4. Token Verification

Use a function like this to verify the token:

import crypto from 'crypto';

function verifyToken(email, token, secretKey) { 
  const expectedToken = crypto 
    .createHmac('sha256', secretKey) 
    .update(email) 
    .digest('hex');

  return token === expectedToken; 
}

5. Handling the Request

Example implementation:

app.get('/landing', (req, res) => { 
  const { token, email } = req.query;
  const decodedEmail = decodeURIComponent(email).replace(/^"(.*)"$/, '$1');

if (verifyToken(decodedEmail, token, process.env.SECRET_KEY)) { 
  // Token is valid, proceed with your application logic 
  res.send('Welcome! Your token is valid.'); 
} else { 
  // Token is invalid 
  res.status(401).send('Invalid token'); 
  } 
});

6. Security Notes

Ensure your SECRET_KEY matches the one used by the Gadget app to generate tokens.
Always use HTTPS in production to protect the token and email in transit.
Implement rate limiting to prevent abuse of your endpoint.

7. Testing

Test by visiting the URL directly in a browser or using tools like curl or Postman.
Modify the token or email slightly to ensure invalid requests are rejected.

Remember: The security of this system relies on keeping the SECRET_KEY confidential and securely stored on your server.

seandogg/README.md