Link Resources with Unique Transaction ID (Monitization)

[Amer-Hijazi]

Good Morning, Team,

I hope everyone is  doing well,

I have one scenario related to monetization, which is as follows:

proxy 1 has 1 API,

proxy 2 has 1 API,

Now I would like to count the transaction based on the response from API 1 if it returns success, and from another API, depending on the reference number. Is that possible?

For example, if the user sends the request to the first API, I will return him redirect URL.

Once he clicks the URL, the HTML page will return to him once he fills in his information and clicks submit the form, then it will reach another API as a callback. How can I register it as a transaction?

For your information, I will use API key and secret key for the first API, so I can know the user, and for the second API, I  will use JWT, so I can't know the user, but there is a reference number returned in the first API and in also return in the callback API.

Any suggestions on how to handle this case? I only need to count the transaction if the user logs in to the page using their credentials using the callback API.

And this is a transaction record config, please correct me if I am wrong, or provide a better solution if you have.

Best Regards,

Amer Hijazi

[AlexET]

Hi @Amer-Hijazi,

I noticed your question hasn’t been answered yet. Don’t worry—we’ll keep an eye on it and try to get some input from other members soon.

[ssvaidyanathan]

@Amer-Hijazi - what JWT are you using? Where is this JWT generated? Doesnt the JWT have the user info in it? Is the callback URL exposed via Apigee, if yes, what is being sent? Can you not send the API Key in the form submission so that you can count against that?

[Amer-Hijazi]

Dears @ssvaidyanathan  and @AlexET ,

I appreciate your support.

I mean, I only use the Verify JWT to verify the JWT that is generated from the backend in the second call, and the Algorithm is RS256.

I only use the API key in the first call because the service used by the service provider allows users to use their services; in the second one (callback), the website will send a JWT, and I will only use it. To verify and extract the information, I can not use the API key because this is used by all users. I can not create Apikey for all users it is used by a huge number of users.

Yes, the callback exposed by Apigee and I will use JWT in the callback only once the user enters their info, then the backend will send the callback through Apigee that contains JWT only.

I hope my answer is clear. Looking for your kind support and response.

Thank you and regards 

[ssvaidyanathan]

@Amer-Hijazi not sure am following the entire picture. Can you probably draw a flow diagram and share that so that I can understand the flow between the various actors

[Amer-Hijazi]

Dear @ssvaidyanathan ,

Sorry for being late in responding, but I was preparing the diagram. As you can see below, the Apigee will be called in flow 1 and flow 3, and there will be a number or ID returned in the flow 1 response, and also will receive in the flow 3 request and I would like to charge the service providers if thire users use my service for SSO.

I hope it is clear; if not, please let me know

[ssvaidyanathan]

Thanks @Amer-Hijazi 

Getting a little bit more clarity now. The issue is connecting Flow 1 and Flow 3 as Flow 2 does not involve Apigee at all.

So - why dont we check these options:

1) Include Apigee in flow 2 as well? Meaning when the web page submits the form, make the call to Apigee, let Apigee forward it to NIC (will that be possible)?

2) Or if 1 is not possible, how about if you can share more info on what the JWT created contains? And in your last message you mentioned "depending on the *ID* return from the first call" - What id is this and who generates this id?

Am happy to jump on a call and discuss this with you as well. I am based in Pacific timezone

[Amer-Hijazi]

Hello @ssvaidyanathan ,

1- We can not include flow 2 inside Apigee because it requires the person's credentials, which the government service provider (NIC) does not allow.

2- JWT includes the user's national ID and their information, and it will be encrypted (JWE), and I will decrypt it inside Apigee.

And for the last part, we can not depend on the user ID because I will charge the service provider, use the API in flow 1 (Mean telecom company, etc), not charge the user itself. 

Also, in the first call, UUID will be returned in the response of flow 1, and the same UUID will be sent in the callback of the request in flow 3.

I am in the GMT+3 zone, and I will send a private message to discuss the call.

Best Regards

[ssvaidyanathan · Accepted solution]

@Amer-Hijazi 

What we could do is store the state returned in the first call in a session with the API Key before doing the redirect. And then once Flow 3 comes to Apigee as part of the callback, extract the state and then do a cache lookup to fetch the API Key.. Once you have that, you can use that as to monetize

[Amer-Hijazi]

Dear @ssvaidyanathan ,

Thank you for being so supportive. I appreciate your time and effort.

Regards,