Sniip Identity API

import os, hmac, hashlib, requests
from flask import Flask, redirect, request, jsonify

app = Flask(__name__)
API_KEY = os.environ['SNIIP_API_KEY']

# Step 1: Create session and redirect
@app.route('/verify-user')
def start_verify():
    resp = requests.post(
        'https://id.sniip.com/api/v1/verify/session',
        headers={'X-API-Key': API_KEY},
        data={
            'reference_id':  'user_456',
            'redirect_url':  'https://yourapp.com/done',
            'webhook_url':   'https://yourapp.com/hook',
        },
        files={'document': open('id_photo.jpg', 'rb')},
    )
    data = resp.json()
    print('Session:', data['session_id'])
    return redirect(data['verify_url'])

# Step 2: Handle webhook
@app.route('/hook', methods=['POST'])
def webhook():
    # Verify HMAC signature
    sig = request.headers.get('X-Sniip-Signature', '')
    expected = hmac.new(
        API_KEY.encode(), request.data, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(sig, expected):
        return 'Invalid signature', 401

    data = request.json
    print('Verified:', data['reference_id'],
          'match:', data['result']['face_match'])
    return '', 200

// create-session.php - Step 1
$apiKey = getenv('SNIIP_API_KEY');
$ch = curl_init('https://id.sniip.com/api/v1/verify/session');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['X-API-Key: ' . $apiKey],
    CURLOPT_POSTFIELDS     => [
        'reference_id' => $userId,
        'redirect_url' => 'https://yoursite.com/done',
        'webhook_url'  => 'https://yoursite.com/webhook.php',
        'document'     => new CURLFile('id_photo.jpg'),
    ],
]);
$result = json_decode(curl_exec($ch), true);
error_log('Session: ' . $result['session_id']);
header('Location: ' . $result['verify_url']);
exit;

// webhook.php - Step 2
$body    = file_get_contents('php://input');
$sig     = $_SERVER['HTTP_X_SNIIP_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $body, $apiKey);

if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Invalid signature');
}

$data  = json_decode($body, true);
$match = $data['result']['face_match'];
http_response_code(200);

package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "mime/multipart"
    "net/http"
    "os"
)

// Step 1: Create session
func createSession(refID, docPath string) (string, error) {
    body := &bytes.Buffer{}
    w := multipart.NewWriter(body)
    w.WriteField("reference_id", refID)
    w.WriteField("redirect_url", "https://yourapp.com/done")
    w.WriteField("webhook_url", "https://yourapp.com/hook")

    fw, _ := w.CreateFormFile("document", "id.jpg")
    f, _ := os.Open(docPath)
    io.Copy(fw, f)
    f.Close()
    w.Close()

    req, _ := http.NewRequest("POST",
        "https://id.sniip.com/api/v1/verify/session", body)
    req.Header.Set("X-API-Key", os.Getenv("SNIIP_API_KEY"))
    req.Header.Set("Content-Type", w.FormDataContentType())

    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()

    var result struct{
        SessionID string `json:"session_id"`
        VerifyURL string `json:"verify_url"`
    }
    json.NewDecoder(resp.Body).Decode(&result)
    // result.SessionID = "9c77d4c1..." (use for tracking)
    return result.VerifyURL, nil
}

// Step 2: Webhook handler
func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    sig := r.Header.Get("X-Sniip-Signature")

    mac := hmac.New(sha256.New, []byte(os.Getenv("SNIIP_API_KEY")))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(sig), []byte(expected)) {
        http.Error(w, "Invalid signature", 401)
        return
    }

    var payload map[string]interface{}
    json.Unmarshal(body, &payload)
    w.WriteHeader(200)
}