Integrate "Verify with FotoID.me"

const res = await fetch('https://api.fotoid.me/api/VerificationSession', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.FOTOID_API_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: user.email,                       // optional: omit for a QR-only session
    requiredFields: ['firstName', 'lastName', 'dateOfBirth'],
    livePhotoRequired: true,
    encryptionKeys: { publicKey: PUBLIC_KEY_PEM, keyId: 'key-2026-11', algorithm: 'RSA-2048' },
    callbackUrl: 'https://you.example/webhooks/fotoid',
    expiresInSeconds: 300
  })
});

const { hasErrors, content, apiErrors } = await res.json();
if (hasErrors) throw new Error(apiErrors[0].errorText);

req.session.fotoid = { id: content.sessionId, challenge: content.challenge };
// Render content.qrCodeSvg next to a "Check your phone" message.

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json.Nodes;

var http = new HttpClient { BaseAddress = new Uri("https://api.fotoid.me/") };
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", config["FotoID:ApiKey"]);

var response = await http.PostAsJsonAsync("api/VerificationSession", new
{
    email = user.Email,                       // optional: omit for a QR-only session
    requiredFields = new[] { "firstName", "lastName", "dateOfBirth" },
    livePhotoRequired = true,
    encryptionKeys = new { publicKey = publicKeyPem, keyId = "key-2026-11", algorithm = "RSA-2048" },
    callbackUrl = "https://you.example/webhooks/fotoid",
    expiresInSeconds = 300
});

var json = await response.Content.ReadFromJsonAsync<JsonNode>();
var content = json!["content"]!;
HttpContext.Session.SetString("fotoid.id", (string)content["sessionId"]!);
HttpContext.Session.SetString("fotoid.challenge", (string)content["challenge"]!);
// Render (string)content["qrCodeSvg"] next to a "Check your phone" message.

import os, requests

r = requests.post(
    "https://api.fotoid.me/api/VerificationSession",
    headers={"Authorization": f"Bearer {os.environ['FOTOID_API_KEY']}"},
    json={
        "email": user.email,  # optional: omit for a QR-only session
        "requiredFields": ["firstName", "lastName", "dateOfBirth"],
        "livePhotoRequired": True,
        "encryptionKeys": {"publicKey": PUBLIC_KEY_PEM, "keyId": "key-2026-11", "algorithm": "RSA-2048"},
        "callbackUrl": "https://you.example/webhooks/fotoid",
        "expiresInSeconds": 300,
    },
    timeout=10,
)
body = r.json()
if body["hasErrors"]:
    raise RuntimeError(body["apiErrors"][0]["errorText"])

session["fotoid"] = {"id": body["content"]["sessionId"], "challenge": body["content"]["challenge"]}

using System.Security.Cryptography;
using System.Text;

static bool VerifyFotoIDSignature(string body, string? header, string secret)
{
    if (string.IsNullOrEmpty(header)) return false;
    var parts = header.Split(',').Select(p => p.Split('=', 2)).Where(p => p.Length == 2)
                      .ToDictionary(p => p[0], p => p[1]);
    if (!parts.TryGetValue("t", out var t) || !parts.TryGetValue("v1", out var v1)
        || !long.TryParse(t, out var unix)) return false;
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - unix) > 300) return false; // stale

    var expected = HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), Encoding.UTF8.GetBytes(t + "." + body));
    try { return CryptographicOperations.FixedTimeEquals(expected, Convert.FromHexString(v1)); }
    catch (FormatException) { return false; }
}

import hashlib, hmac, time

def verify_fotoid_signature(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in (header or "").split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not t.isdigit() or not v1 or abs(time.time() - int(t)) > 300:
        return False  # stale or replayed
    expected = hmac.new(secret.encode(), t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

using System.Security.Cryptography;
using System.Text.Json.Nodes;

static JsonNode DecryptFotoID(JsonNode p, RSA privateKey)
{
    var aesKey = privateKey.Decrypt(Convert.FromBase64String((string)p["encryptedKey"]!),
                                    RSAEncryptionPadding.OaepSHA256);

    var cipher = Convert.FromBase64String((string)p["ciphertext"]!);
    var plain = new byte[cipher.Length];
    using var gcm = new AesGcm(aesKey, 16);
    gcm.Decrypt(Convert.FromBase64String((string)p["iv"]!), cipher,
                Convert.FromBase64String((string)p["tag"]!), plain);
    return JsonNode.Parse(plain)!;
}

using var rsa = RSA.Create();
rsa.ImportFromPem(privateKeyPem);
var result = DecryptFotoID(content["response"]!, rsa);
if ((string)result["challenge"]! != HttpContext.Session.GetString("fotoid.challenge"))
    throw new CryptographicException("Challenge mismatch");

# pip install cryptography
import base64, hmac, json
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def decrypt_fotoid(p: dict, private_key) -> dict:
    aes_key = private_key.decrypt(
        base64.b64decode(p["encryptedKey"]),
        padding.OAEP(mgf=padding.MGF1(hashes.SHA256()), algorithm=hashes.SHA256(), label=None),
    )
    sealed = base64.b64decode(p["ciphertext"]) + base64.b64decode(p["tag"])
    return json.loads(AESGCM(aes_key).decrypt(base64.b64decode(p["iv"]), sealed, None))

private_key = serialization.load_pem_private_key(open("fotoid-private.pem", "rb").read(), None)
result = decrypt_fotoid(content["response"], private_key)
if not hmac.compare_digest(result["challenge"], session["fotoid"]["challenge"]):
    raise ValueError("Challenge mismatch")