Send Authentication Template

{
  "fullPhoneNumber": "+919028883545",
  "callbackData": "auth_attempt_42",
  "type": "Template",
  "template": {
    "name": "itk_auth_one_tap",
    "bodyValues": ["483920"]
  }
}

curl -X POST https://api.splashifypro.com/api/v1/public/message \
  -H "Authorization: Basic YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fullPhoneNumber": "+919028883545",
    "callbackData": "login_attempt_42",
    "type": "Template",
    "template": {
      "name": "itk_auth_one_tap",
      "bodyValues": ["483920"]
    }
  }'

async function sendLoginOtp(phone: string, otp: string) {
  const res = await fetch(
    "https://api.splashifypro.com/api/v1/public/message",
    {
      method: "POST",
      headers: {
        "Authorization": `Basic ${process.env.SPLASHIFY_API_KEY!}`,
        "Content-Type":  "application/json",
      },
      body: JSON.stringify({
        fullPhoneNumber: phone,            // "+919028883545"
        callbackData:    `login:${phone}`, // echoed in webhooks
        type: "Template",
        template: {
          name:       "itk_auth_one_tap",
          bodyValues: [otp],
        },
      }),
    },
  );

  const data = await res.json();
  if (!data.result) throw new Error(`${res.status}: ${data.message}`);
  return data.id; // Splashify message ID — correlate with delivery webhooks
}

import os, requests

def send_login_otp(phone: str, otp: str) -> str:
    r = requests.post(
        "https://api.splashifypro.com/api/v1/public/message",
        headers={
            "Authorization": f"Basic {os.environ['SPLASHIFY_API_KEY']}",
            "Content-Type":  "application/json",
        },
        json={
            "fullPhoneNumber": phone,
            "callbackData":    f"login:{phone}",
            "type": "Template",
            "template": {
                "name":       "itk_auth_one_tap",
                "bodyValues": [otp],
            },
        },
        timeout=30,
    )
    data = r.json()
    if not data.get("result"):
        raise RuntimeError(f"{r.status_code}: {data.get('message')}")
    return data["id"]

{
  "result": true,
  "message": "Message created successfully",
  "id": "b90f02bd-1316-49ce-b5d0-f6be14fce2b8"
}

const res = await fetch("https://api.splashifypro.com/api/v1/public/message", { /* ... */ });
if (!res.ok) {
  const body = await res.text();
  console.error("Splashify send failed", { status: res.status, body });
  // body will contain { result: false, message: "..." } — that's the real error
  return new Response(body, { status: res.status });
}

// supabase/functions/send-sms-hook/index.ts
import { serve } from "https://deno.land/std/http/server.ts";
import { createHmac } from "node:crypto";

const HOOK_SECRET = Deno.env.get("SEND_SMS_HOOK_SECRET")!;
const API_KEY     = Deno.env.get("SPLASHIFY_API_KEY")!;
const TEMPLATE    = Deno.env.get("SPLASHIFY_TEMPLATE_NAME") ?? "otp";
// Optional — only set if you need to override the language stored on the template.
const LANGUAGE    = Deno.env.get("SPLASHIFY_TEMPLATE_LANGUAGE");

serve(async (req) => {
  // 1. Verify Supabase Auth's signed payload (standard webhook HMAC).
  //    Skip this in dev only — never in production.
  const sig = req.headers.get("webhook-signature") ?? "";
  const raw = await req.text();
  const expected = createHmac("sha256", HOOK_SECRET).update(raw).digest("hex");
  if (sig !== expected) {
    return new Response("invalid signature", { status: 401 });
  }

  const { user, sms } = JSON.parse(raw) as {
    user: { id: string; phone: string };
    sms:  { otp: string; sms_type: string };
  };

  // 2. Send the WhatsApp auth template.
  const phone = user.phone.startsWith("+") ? user.phone : `+${user.phone}`;
  const splash = await fetch(
    "https://api.splashifypro.com/api/v1/public/message",
    {
      method: "POST",
      headers: {
        "Authorization": `Basic ${API_KEY}`,
        "Content-Type":  "application/json",
      },
      body: JSON.stringify({
        fullPhoneNumber: phone,
        callbackData:    `auth:${user.id}`,
        type: "Template",
        template: {
          name:       TEMPLATE,
          ...(LANGUAGE ? { languageCode: LANGUAGE } : {}),
          bodyValues: [sms.otp],
        },
      }),
    },
  );

  // 3. Surface the real error if the send fails — don't return generic 5xx.
  if (!splash.ok) {
    const body = await splash.text();
    console.error("Splashify send failed", { status: splash.status, body });
    return new Response(body, { status: splash.status });
  }

  return new Response(JSON.stringify({ ok: true }), {
    status: 200,
    headers: { "Content-Type": "application/json" },
  });
});

supabase secrets set \
  SPLASHIFY_API_KEY=sk_live_your_rotated_key \
  SPLASHIFY_TEMPLATE_NAME=otp \
  SEND_SMS_HOOK_SECRET=$(openssl rand -hex 32)
# SPLASHIFY_TEMPLATE_LANGUAGE is optional — set it only to override
# the language stored on the template (e.g. for multi-language OTPs).

await supabase.auth.signInWithOtp({ phone: "+919028883545" });
// user types the 6 digits they read in WhatsApp:
await supabase.auth.verifyOtp({ phone, token, type: "sms" });