Authentication

// `account` is a viem LocalAccount for the card key.
// The app gets it from the passkey (apps/web/lib/passkey.ts); in a script you can use
// privateKeyToAccount from "viem/accounts".

const API = "https://api.tozzecard.xyz";

const { message } = await fetch(`${API}/auth/challenge`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ address: account.address }),
}).then((r) => r.json());

const { token, kyc, card } = await fetch(`${API}/auth/verify`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ message, signature: await account.signMessage({ message }) }),
}).then((r) => r.json());
// kyc: "none" | "pending" | "approved" | "declined" | "duplicate"; card is null until "approved"

const auth = { authorization: `Bearer ${token}`, "content-type": "application/json" };
const { url } = await fetch(`${API}/kyc/session`, {
  method: "POST",
  headers: auth,
  body: JSON.stringify({ returnUrl: "https://app.tozzecard.xyz/" }),
}).then((r) => r.json());
location.href = url; // Didit: document + selfie, then back to returnUrl

// Back in the app: poll while pending
const me = await fetch(`${API}/me`, { headers: auth }).then((r) => r.json());