Conversation
andrewkmin
left a comment
andrewkmin
left a comment
There was a problem hiding this comment.
looks great! nonblocking comments.
there is one additional area we could update (h/t @t-vila for the callout): https://docs.turnkey.com/security/enclave-secure-channels#:~:text=Our%20OTP%20flows%20work%20similarly%2C%20except%20the%20bundle%20is%20not%20emailed%20to%20the%20user%20directly.%20Instead%2C%20it%20is%20returned%20as%20part%20of%20the%20OTP_AUTH%20activity%20results
| @@ -0,0 +1,34 @@ | |||
| --- | |||
| title: "Updated OTP Login and Signup Flow" | |||
There was a problem hiding this comment.
Tiny nit: can we go with sentence case here?
| title: "Updated OTP Login and Signup Flow" | |
| title: "Updated OTP login and signup flow" |
andrewkmin
force-pushed
the
feat/otp-enclave-security-docs
branch
from
67541b9 to
4ce2207
Compare
| The following updates are required to legacy OTP implementations to migrate to the updated OTP flow, after bumping SDK versions: | ||
|
|
||
| - The response shape for `ACTIVITY_TYPE_INIT_OTP_V3` now includes an `otpEncryptionTargetBundle` which is to be used during otp verification. This requires persisting state between `INIT_OTP` and `VERIFY_OTP` which means OTP flows need to be initiated and verified by the same service, or the service initiating OTP needs to pass the encryption bundle received in the response to the app client which will verify the OTP code. | ||
| - The request shape for `ACTIVITY_TYPE_VERIFY_OTP_V2` now includes an `encryptedOtpBundle` which is generated using the `otpEncryptionTargetBundle` received from `INIT_OTP`. This bundle will include a client-generated public key and the OTP code attempt. |
There was a problem hiding this comment.
I think we need to mention somewhere in these docs that the encryptOtpCodeToBundle helper from @turnkey/crypto is used to get the encryptedOtpBundle for this step.
Looking at the SDK changelogs and these docs, we actually don't mention this anywhere!
There was a problem hiding this comment.
Was planning on linking to these docs in the sdk changelog of this PR
3 participants
No description provided.