chore(update): Update passkeys-backend to use verify instead of comms by nicolas-camacho · Pull Request #607 · twilio-labs/function-templates

nicolas-camacho · 2025-09-23T14:43:51Z

Description

Migration from using the comms API to Verify API

Checklist

I ran npm test locally and it passed without errors.
I acknowledge that all my contributions will be made under the project's license.

Related issues

yafuquen · 2025-09-23T17:15:46Z

passkeys-backend/functions/registration/service.js

+    const createServiceURL = `${API_URL}`;
+
+    try {
+      const APIResponse = await axios.post(createServiceURL, data, {


Do we need to include documentation in the README to explain why and how to use this?

yafuquen · 2025-09-23T19:00:45Z

package-lock.json

+        "zod": "^3.24.4"
+      }
+    },
+    "mcp-server/node_modules/@twilio-labs/serverless-runtime-types": {


Are these changes needed?

yafuquen · 2025-09-23T19:02:10Z

passkeys-backend/README.md

 | `ACCOUNT_SID`        | Find in the [console](https://www.twilio.com/console) | Yes |
 | `AUTH_TOKEN`         | Find in the [console](https://www.twilio.com/console) | Yes |
-| `ANDROID_APP_KEYS`   | The domain of the Android identity providers hash     | No  |
+| `NAMESPACE`   | UUID for generating deterministic UUIDs with the uuid library for username conversion  | No  |


If this is not required, why is it needed? Can the function manage it by itself?

This should be required, change it right now

yafuquen · 2025-09-23T19:03:13Z

passkeys-backend/assets/origins.js

@@ -0,0 +1,8 @@
+const origins = (context) => {
+  const { DOMAIN_NAME } = context;
+  return [`https://${DOMAIN_NAME}`, 'android:apk-key-hash:{base64_hash}'];


Is this for Android & Web? What about iOS?

iOS only need the apple-app-site-association, it uses backend domain as its origin

yafuquen · 2025-09-23T19:07:34Z

passkeys-backend/functions/registration/start.js

-    if (!keys || keys.trim() === '""') return [];
-    return keys.split(',');
-  };
+  const uuidIdentity = v5(event.username, NAMESPACE);


Could it be possible to use something already included as library (to prevent adding a new library)? Could it be possible to use a hash of the value?

The API specifies a UUID format, it reject the request if this specification is not fulfil

yafuquen · 2025-09-23T19:54:45Z

passkeys-backend/.env.example

+# format: text
 # required: false
-ANDROID_APP_KEYS=
+NAMESPACE=


What is the purpose of this value? What will be the format of the value? Could there be a default value?

The purpose is to create a uuid based on the username, this is described in the readme, I think the UUID as is described is self explanatory, but yes we can add a default value

passkeys-backend/.env.example

yafuquen · 2025-09-23T21:37:38Z

passkeys-backend/functions/registration/start.js


 exports.handler = async (context, event, callback) => {
-  const { DOMAIN_NAME, API_URL, ANDROID_APP_KEYS } = context;
+  const { API_URL, SERVICE_SID, NAMESPACE } = context;


Do you need the NAMESPACE?

yafuquen · 2025-09-23T21:40:09Z

passkeys-backend/.env.example

-# format: list(text)
+# description: [Optional] SID of the service created in Twilio verify
+# format: sid
 # required: false


Should this be true?

I think if I set this to true the code exchange will take it as a mandatory when creating the function, but this is created with one of the endpoints

robinske

I think it's worth bringing in the Twilio helper library for this!

robinske · 2025-09-24T14:35:54Z

passkeys-backend/functions/authentication/start.js

-  };
-
-  const challengeURL = `${API_URL}/Verifications`;
+  const challengeURL = `${API_URL}/${SERVICE_SID}/Passkeys/Challenges`;


do we have a sense of when these endpoints will be available in the Node Helper Library?

robinske · 2025-09-24T14:37:42Z

passkeys-backend/functions/registration/service.js

+  const createServiceURL = `${API_URL}`;
+
+  try {
+    const APIResponse = await axios.post(createServiceURL, data, {


this should already be available in the Node Helper Library - I vote we add that as an import instead of using axios.

chore(update): Update passkeys-backend to use verify instead of comms

a1a072c