Age Verification

// 1. Generate and store a CSRF state token
$state = bin2hex(random_bytes(16)); // 32 hex characters

setcookie('age_verification_state', $state, [
    'expires'  => time() + 900, // 15 minutes
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

// 2. Create the verification
$curl = curl_init('https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/create-age-verification');
curl_setopt($curl, CURLOPT_POST,           true);
curl_setopt($curl, CURLOPT_POSTFIELDS,    json_encode([
    'client_reference' => $userId,
    'state'            => $state,
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER,    [
    'Content-Type: application/json',
    'X-API-Key: '    . $_ENV['PRONTOID_API_KEY'],
    'X-API-Secret: ' . $_ENV['PRONTOID_API_SECRET'],
]);

try {
    $response = curl_exec($curl);

    if (curl_errno($curl)) {
        throw new Exception(curl_error($curl));
    }

    $http_status   = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response_data = json_decode($response, true);

    if ($http_status >= 200 && $http_status < 300
        && isset($response_data['verification_token'])) {

        $verificationToken = $response_data['verification_token'];

        // 3. Save the token against the user before redirecting
        saveAgeVerificationToken($userId, $verificationToken, 'prontoid');

        // 4. Build the redirect URL
        $redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php'
                     . '?verification_token=' . urlencode($verificationToken);
    } else {
        $errorMessage = $response_data['message'] ?? 'Unknown error occurred.';
        throw new Exception('API Gateway Error: ' . $errorMessage);
    }
} catch (Exception $e) {
    $hasError     = true;
    $errorDetails = $e->getMessage();
} finally {
    curl_close($curl);
}

curl -X POST \
  https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/create-age-verification \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -H 'X-API-Secret: YOUR_CLIENT_SECRET' \
  -d '{
    "client_reference": "user_abc123",
    "state":            "a3f8c2d1e4b7"
  }'

{
  "success":            true,
  "verification_token": "vt_…",
  "expires_at":         1735430400,
  "client_reference":   "user_abc123"
}

// On your authorized_user_redirect_uri page:
$returned_state = $_GET['state']                          ?? null;
$stored_state   = $_COOKIE['age_verification_state'] ?? null;

if (!$returned_state || !hash_equals($stored_state, $returned_state)) {
    // State mismatch — abort
    http_response_code(403);
    exit('Invalid state.');
}

// Clear the state cookie
setcookie('age_verification_state', '', time() - 3600, '/');

// Do NOT grant access here — wait for the webhook

$redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php?verification_token='
             . urlencode($verificationToken);

header('Location: ' . $redirectUrl);
exit;

// age-verification-webhook.php

// 1. Read the RAW body — the signature is over these exact bytes.
$raw = file_get_contents('php://input');

// 2. Verify the signature BEFORE parsing or trusting anything.
$signature = $_SERVER['HTTP_X_PRONTO_SIGNATURE'] ?? '';
$expected  = hash_hmac('sha256', $raw, $_ENV['PRONTOID_WEBHOOK_SECRET']);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

$payload = json_decode($raw, true);
$event   = $payload['type'];
$data    = $payload['data']['object'];  // fields are nested here

// 3. Resolve the user from YOUR OWN record of the token you stored
//    when you started the verification. client_reference is a hint —
//    never the source of truth for which account to update.
$row = findVerificationByToken($data['verification_token']);
if (!$row) {
    http_response_code(404);
    exit;
}

// 4. Approve only if the checks passed AND the age threshold was met.
//    is_authentic alone is not enough — a verified minor is authentic.
$approved = $event === 'age_verification.succeeded'
    && $data['is_authentic']
    && $data['is_adult'];

setUserAgeVerified($row['user_id'], $approved);

http_response_code(200);
echo json_encode(['received' => true]);

import hmac, hashlib, json, os

def handle(raw_body: bytes, headers: dict):
    # 1. Verify over the RAW bytes, before parsing.
    expected = hmac.new(
        os.environ['PRONTOID_WEBHOOK_SECRET'].encode(),
        raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, headers.get('X-Pronto-Signature', '')):
        return 401, {'error': 'invalid signature'}

    payload = json.loads(raw_body)
    event   = payload['type']
    data    = payload['data']['object']

    # 2. Your own record decides which user this is.
    row = find_verification(data['verification_token'])
    if not row:
        return 404, {'error': 'unknown verification'}

    approved = (
        event == 'age_verification.succeeded'
        and data['is_authentic']
        and data['is_adult']
    )

    set_age_verified(row['user_id'], approved)
    return 200, {'received': True}

// --- Authenticate the user ---
$accessToken = $YourApp->checkInput($_COOKIE['accessToken']);

if (empty($accessToken)) {
    header('Location: /signin.php?error=session_expired');
    exit;
}

$userId = $YourApp->getUserIdByAccessToken($accessToken);

if (empty($userId)) {
    header('Location: /signin.php?error=user_not_found');
    exit;
}

// --- Generate and store the CSRF state token ---
$state = bin2hex(random_bytes(16));

setcookie('age_verification_state', $state, [
    'expires'  => time() + 900,
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

// --- Call the ProntoID API gateway ---
$API_ENDPOINT = 'https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/create-age-verification';
$API_KEY      = '••••••••••••••••••••••••••'; // load from env / secrets manager
$PLATFORM_ID  = 'yourplatform_xxxxxxxxxxxx';

$curl = curl_init($API_ENDPOINT);
curl_setopt($curl, CURLOPT_POST,           true);
curl_setopt($curl, CURLOPT_POSTFIELDS,    json_encode([
    'client_reference' => $userId,
    'state'            => $state,
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-API-Key: '    . $API_KEY,
    'X-API-Secret: ' . $API_SECRET,
]);

try {
    $response = curl_exec($curl);

    if (curl_errno($curl)) {
        throw new Exception(curl_error($curl));
    }

    $http_status   = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response_data = json_decode($response, true);

    if ($http_status >= 200 && $http_status < 300
        && isset($response_data['verification_token'])) {

        $verificationToken = $response_data['verification_token'];
        $platform          = 'yourplatform';

        // Persist the token — match it to the user when the webhook arrives
        $YourApp->saveAgeVerificationToken($userId, $verificationToken, $platform);

        // Build the ProntoID redirect URL
        $redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php'
                     . '?verification_token=' . urlencode($verificationToken);
    } else {
        $errorMessage = $response_data['message'] ?? 'Unknown error occurred.';
        throw new Exception('API Gateway Error: ' . $errorMessage);
    }
} catch (Exception $e) {
    $hasError     = true;
    $errorDetails = $e->getMessage();
} finally {
    curl_close($curl);
}

<?php if (isset($hasError) && $hasError): ?>

    <!-- ── Error state ── -->
    <h1>Verification Error</h1>
    <p>We encountered an issue while initiating your age verification.</p>
    <div class="error-container">
        <div class="error-heading">Error Details:</div>
        <div class="error-text"><?= htmlspecialchars($errorDetails) ?></div>
    </div>
    <a href="<?= htmlspecialchars($_SERVER['PHP_SELF']) ?>">Try Again</a>

<?php else: ?>

    <!-- ── Success state: spinner + manual fallback ── -->
    <div class="spinner"></div>
    <h1>Redirecting to ProntoID...</h1>
    <p>Please wait while we securely redirect you to complete your age verification.</p>

    <ul>
        <li>You'll be taken to ProntoID's secure platform</li>
        <li>Complete a quick identity verification</li>
        <li>Return to your platform automatically when done</li>
    </ul>

    <p>Not redirecting automatically?</p>
    <a href="<?= htmlspecialchars($redirectUrl) ?>">Click Here to Continue</a>

<?php endif; ?>

<!-- Auto-redirect after 2 s, with click-anywhere fallback -->
<?php if (!isset($hasError)): ?>
<script>
    setTimeout(function() {
        window.location.href = <?= json_encode($redirectUrl) ?>;
    }, 2000);

    // Clicking anywhere also triggers the redirect immediately
    document.addEventListener('click', function() {
        window.location.href = <?= json_encode($redirectUrl) ?>;
    });
</script>
<?php endif; ?>

{
  "id":          "evt_6758afcccdafd2eb",
  "object":      "event",
  "api_version": "1.0",
  "created":     1735430400,
  "type":        "age_verification.succeeded",
  // The result fields are nested under data.object —
  // not at the top level.
  "data": {
    "object": {
      "verification_token":  "cf268392002f400a…",
      "platform_id":         "myapp_a1b2c3",
      "verification_status": "complete",
      "age_status":          "verified_adult",
      "is_adult":            true,        // met YOUR configured minimum_age
      "minimum_age":         18,          // the threshold that was applied
      "is_authentic":        true,        // document + liveness checks passed
      "age":                27,
      "client_reference":    "user_abc123",
      "state":               "a3f8c2d1e4b7",
      "completed_at":        1735430400
    }
  }
}