Using Webhook as trigger for API requests - Aries Cloud Agent and Android

Question

My idea is to use verifiable credentials for logging into my Kotlin Android app. For that purpose I use Aries Cloud Agent (aca-py). For communication with an agent there is an API. This agent enables creation of the connection between wallet (lissi, trinsic, esatus, etc.) and agent and afterwards sending proof request. The data from proof request (verifiable credential with for example first name, last name, email) are than used to login.

Each of these steps requires specific API request. It is possible to implement each step as separate button. In that case, user should first press button to create QR code that can be scanned from wallet and therefore establish connection. After than second button should be pressed to send proof request. And once the credentials are presented, third button should be pressed so that an app takes that info from agent with a GET request. However my idea is to automate this whole process.

That can be done using agents webhooks that can inform app once there is a new connection created and that can be used as trigger to send second proof request. The same happens once the proof request is sent. However, I am not sure how to implement push notification into my app once there is a new webhook.

I read that it can be done with Firebase and AWS Amplify. In both cases I think should pay for it and to be honest I am not too familiar with their services. Is there some other option? Does anyone know some free alternative? Currently my idea is just to build like a prototype so there is no need for production services. Thanks in advance!

Answer 1

A web hook is basically an external-facing URL which can take a payload, etc. You can create these endpoints using Cloud Functions onRequest. these use express based request/response callbacks

• https://firebase.google.com/docs/reference/functions/providers_https_#onrequest
• http://expressjs.com/en/4x/api.html#res

For example: From the client side, Start a listener in realtime db to the users ID, then: Create a dynamic link or a cloud function URL which can be rendered as a QR code A B C, and from there: a series of URL's and Dynamic Links for each step of the way. the user's client can get real-time updates from Firebase while this process is going on, allowing you to update the user with the current process and instructions.

• https://firebase.google.com/docs/database/web/read-and-write#web-v8_2

The keynote is to associate the process with a one-time disposable token, so that your webhooks can know which user the process can follow. You could use the user's ID, but this can be predicted and spoofed if any webhook endpoint is exposed.

Realtime DB:

processing: // location for all clients processing can listen to for updates
 +userId: { // userID so that the location is predictable should the client disconnect
     +--"State": "state1",
     +--"URL":"https://url.for.qr/code?=disposable_token"
  }
status: // location for all webhook processing and tracking of stats
 +token: { // userID so that the outcome is predictable should the client disconnect
     +--"User": "userID",
     +--"stage":"authenticating"
     +--"createdAt":"Date.now()"// track when the process started, ensure that requests can expire after X minutes/hours
  }

To the client, the button presses can be automated purely with a realtime db listener