nOTP (WhatsApp) Authentication with Backend SDKs

npm i --save @descope/node-sdk

import DescopeClient from '@descope/node-sdk';
try{
    //  baseUrl="<URL>" // When initializing the Descope client, you can also configure the baseUrl ex: https://auth.company.com  - this is useful when you utilize a custom domain within your Descope project.
    const descopeClient = DescopeClient({ projectId: '__ProjectID__' });
} catch (error) {
    // handle the error
    console.log("failed to initialize: " + error)
}

// Args:
//    user: Optional user object to populate new user information.
const user = { "name": "Joe Person", "phone": "+15555555555", "email": "email@company.com"}
//    loginId: email or phone - becomes the unique ID for the user from here on and also used for delivery
const loginId = "email@company.com"
const resp = await descopeClient.notp.signUp(loginId, user);
if (!resp.ok) {
  console.log("Failed to initialize NOTP signup")
  console.log("Status Code: " + resp.code)
  console.log("Error Code: " + resp.error.errorCode)
  console.log("Error Description: " + resp.error.errorDescription)
  console.log("Error Message: " + resp.error.errorMessage)
}
else {
  console.log("Successfully initialized NOTP signup.")
  // resp.data contains { pendingRef, redirectUrl, image }
  // Present the QR `image` or send the user to `redirectUrl` to complete auth
  console.log(resp.data)
}

// Args:
//    loginId: email or phone - must be same as provided at the time of signup.
const loginId = "email@company.com"
//    loginOptions (LoginOptions): this allows you to configure behavior during the authentication process.
const loginOptions = {
      "stepup": false,
      "mfa": false,
      "customClaims": {"claim": "Value1"},
      "templateOptions": {"option": "Value1"}
    }
//    refreshToken (optional): the user's current refresh token in the event of stepup/mfa
const resp = await descopeClient.notp.signIn(loginId, loginOptions);
if (!resp.ok) {
  console.log("Failed to initialize NOTP Sign-In")
  console.log("Status Code: " + resp.code)
  console.log("Error Code: " + resp.error.errorCode)
  console.log("Error Description: " + resp.error.errorDescription)
  console.log("Error Message: " + resp.error.errorMessage)
}
else {
  console.log("Successfully initialized NOTP Sign-In.")
  // resp.data contains { pendingRef, redirectUrl, image }
  // Present the QR `image` or send the user to `redirectUrl` to complete sign-in
  console.log(resp.data)
}

// Args:
//    loginId: email or phone - becomes the unique ID for the user from here on and also used for delivery.
const loginId = "email@company.com"
//    signUpOptions (SignUpOptions): this allows you to configure behavior during the authentication process.
const signUpOptions = {
      "customClaims": {"claim": "Value1"},
      "templateOptions": {"option": "Value1"}
    }
const resp = await descopeClient.notp.signUpOrIn(loginId, signUpOptions);
if (!resp.ok) {
  console.log("Failed to initialize NOTP Sign-Up or Sign-In")
  console.log("Status Code: " + resp.code)
  console.log("Error Code: " + resp.error.errorCode)
  console.log("Error Description: " + resp.error.errorDescription)
  console.log("Error Message: " + resp.error.errorMessage)
}
else {
  console.log("Successfully initialized NOTP Sign-Up or Sign-In.")
  // resp.data contains { pendingRef, redirectUrl, image }
  // Present the QR `image` or send the user to `redirectUrl` to complete authentication
  console.log(resp.data)
}

//    ctx: context.Context - Application context for the request (supports cancellation, etc.).
//    loginID: The login ID of the user to update, should be a phone number.
//    phone: The new phone number to set for the user (or leave empty to use the WhatsApp phone number during verification).
//    updateOptions: (optional) *descope.NOTPUpdateOptions for advanced update flows (custom claims, template options, etc.).
//    r: *http.Request - the incoming HTTP request, used to extract the user's refresh token (required for the update).

ctx := context.Background()
loginID := "+15555555555" // The login ID of the user being updated (a phone number).
phone := "+15556667777"   // The new phone number to set. Can be "" (empty) to allow the WhatsApp phone number to be used.

// The user's refresh token is extracted from the incoming request, so pass the *http.Request from your handler.
var r *http.Request = nil // Replace with your actual http.Request.

// Example updateOptions. See SDK docs for all available options.
// For defaults, set to nil.
updateOptions := &descope.NOTPUpdateOptions{
    // CustomClaims:    map[string]any{"role": "user"},
    // TemplateID:      "your-custom-template",
    // TemplateOptions: map[string]string{"greeting": "Hi"},
}

// Call the UpdateUser function to initiate the nOTP (WhatsApp) update flow.
resp, err := descopeClient.Auth.NOTP.UpdateUser(ctx, loginID, phone, updateOptions, r)
if err != nil {
    fmt.Println("Failed to start nOTP (WhatsApp) update user flow:", err)
    return
}
// resp will include a redirect URL and/or QR code image, plus a pending reference used to poll for the session.
fmt.Println("Successfully started nOTP sign-in (WhatsApp).")
fmt.Println("Redirect URL:", resp.RedirectURL)
if resp.Image != "" {
    fmt.Println("QR Code image (base64):", resp.Image)
}
// Save resp.PendingRef and pass it to GetSession to complete the flow.
fmt.Println("Pending reference:", resp.PendingRef)

// Args:
//    pendingRef: the reference string returned from notp.signIn / signUp / signUpOrIn.
const pendingRef = resp.data.pendingRef
//    config (optional WaitForSessionConfig): tune how long and how often to poll.
const config = {
      "timeoutMs": 120000,        // give up after 2 minutes (default applies if omitted)
      "pollingIntervalMs": 1000   // poll once per second (default applies if omitted)
    }
const sessionResp = await descopeClient.notp.waitForSession(pendingRef, config);
if (!sessionResp.ok) {
  // Note: a timeout does NOT throw - it resolves with ok: false, so check it here.
  console.log("Failed to complete NOTP authentication")
  console.log("Status Code: " + sessionResp.code)
  console.log("Error Code: " + sessionResp.error.errorCode)
  console.log("Error Description: " + sessionResp.error.errorDescription)
  console.log("Error Message: " + sessionResp.error.errorMessage)
}
else {
  const { sessionJwt, refreshJwt, user, firstSeen } = sessionResp.data
  console.log("Successfully authenticated via NOTP.")
  console.log("Session JWT:", sessionJwt)
  console.log("Refresh JWT:", refreshJwt)
  console.log("User ID:", user.userId)
  console.log("First seen (new user):", firstSeen)
}