📚 Documentation: Phone verification race condition

[geek-at]

💭 Description

I installed appwrite to be able to authenticate users faster using SMS and Twilio as a backend.

I'm having a hard time doing server side verification because I want the user to enter their phone number in JS (frontend) and verify it using PHP but this seems to be impossible because the documentation for the Phone verification requires already a JWT which can only be issued when authentication is already finished.

In JS I have to call createPhoneSession and then run updatePhoneSession to verify the code and only when this was successful I can issue a JWT using account.createJWT()

In PHP this code fails

$client = new Client();

$client
    ->setEndpoint('https://myurl/v1')
    ->setProject('652d4af1633afc99def')
    ->setKey('528958d6e5f[..]e318fc67') // Your secret API key
    ->setSelfSigned()
;

$userid="652d5b5a9a699deabcce"; //would get this from an AJAX request from the frontend
$secret="243503"; //phone verification token

$account = new Account($client);
$result = $account->updatePhoneVerification($userid, $secret);
var_dump($result);

It fails with the error: (role: applications) missing scope (public) which means that using a API secret you can't confirm the users phone token. It needs setJWT instead of setKey but again the JWT can only be issued after authentication.

So why do these endpoints even exist in PHP when you can't use it for authentication in the backend? How is this meant to be used? Anonymous logins and afterwards backend checks?

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

[ChiragAgg5k]

@geek-at hi there! sorry for the extremely late reply...

JWTs are basically just a stateless proof of identity of the user making a request from your client side code. Your server side code just verifies the JWT for each request regardless if the user is "logged in" or what I think you mean is even created. Creation of a JWT does not require any parameters:

const user = await account.createJWT();

You just need to create a JWT before you even authenticate the user to verify the user on server side before you can all the updatePhoneVerification method.

You can find more about JWTs and how appwrite implements them here - https://appwrite.io/docs/products/auth/jwt#jwt

Hope that helps! Feel free to reach out again.