如何使用oAuth / http标头用户名和密码保护Nexmo回调URL

Question

I have been looking into Nexmo documentation ( https://docs.nexmo.com/index.php/sms-api/handle-inbound-message ) for inbound messages and have a query.

I want to make sure that the URL is being called from Nexmo and Nexmo alone. So in order to secure my end-point how do I specify token or username and password parameters/ http headers so that its secure?

Any help is appreciated.

Thanks

Answer 1

Rohit, I understand what you're looking for but that is not supported by their API. Another option for you is to use the messageId sent to you and then go get the message details yourself via the Message Search API, https://docs.nexmo.com/index.php/developer-api/search-message .

So if you get a call something like:

?msisdn=19150000001&to=12108054321&messageId=000000FFFB0356D1&text=This+is+an+inbound+message&type=text&message-timestamp=2012-08-19+20%3A38%3A23

Then you can turn around and call:

https://rest.nexmo.com/sms/json/search/message/{api_key}/{api_secret}/000000FFFB0356D1

Since you authenticate yourself to Nexmo and fetch the information yourself you can trust it at this point, rather than trusting what was sent to your endpoint. That way if someone sends you a junk messageId you'll find out when Nexmo tells you it is invalid.

Answer 2

You can append custom query parameters to your request, so you should be able to pass in security credentials that way. You should of course be sure to use HTTPS in that case.

https://help.nexmo.com/hc/en-us/articles/203806548-Can-I-Append-Custom-Parameters-to-the-Callback-URL-