Sign Proof Requests
The user should know that the proof is being requested by you and not a phishing website. In order to do that, we require all the proof requests to be signed before the user is asked to generate the proofs.
Because of security concerns it is not safe to have the APP_SECRET on the front-end. If it is on the frontend, any malicious user can extract the APP_SECRET and build a phishing website to emulate you.
Setup a backend endpoint
So, to sign the proof requests, we recommend you setting up a backend endpoint. This endpoint must take the provider id, authenticate the user, and respond with a signed URI for the user to open.
import { Reclaim } from '@reclaimprotocol/js-sdk'
router.post('/sign', async function (req, res) {
const { providerId } = req.body
const reclaimClient = new Reclaim.ProofRequest(APP_ID) //TODO: Update APP_ID with your app id
await reclaimClient.buildProofRequest(providerId)
reclaimClient.setSignature(
await reclaimClient.generateSignature(
APP_SECRET //TODO : Update APP_SECRET with your app secret
)
)
const { requestUrl: signedUrl } =
await reclaimClient.createVerificationRequest()
res.send(signedUrl)
})
Note that in case you don't pass a sessionId
to the constructor, the SDK will generate a random one for you, but you can also pass it:
const reclaimClient = new Reclaim.ProofRequest(APP_ID, req.body.sessionId)