1. Your Mini App (or the API Consumer) prepares the required tokens and credentials acquired from the Maya Mini App:
   • Customer Access Token: the accessToken obtained from Maya through either your session URL or acquired by refreshing the tokens , whichever is the most recent or valid value
   • Client Credentials Token: the access_token acquired during OAuth 2.0 Authentication using the client_credentials grant type
2. The API Consumer calls the Get Profile endpoint of the Maya Mini App, providing the accessToken and access_token.
3. Maya Mini App processes the request and retrieves the profile data based on the client scope. Refer to the Supported Scopes section for the list of scopes.
4. After retrieving the profile data, the Maya Mini App sends the encrypted profile data to the API Consumer.
5. The API Consumer decrypts the profile data using the JSON Web Encryption (JWE) and JSON Web Key (JWK) keys acquired during onboarding. JWK is a JSON object that represents a cryptographic key.
6. The API Consumer processes the raw profile data.
7. When new Customer:
   • The API Consumer triggers their registration process.
   • When API Consumer requires additional customer information not available in Maya Mini App's Supported Scopes:
     • The API Consumer asks the Customer for additional information.
     • The Customer inputs and submits additional information to the API Consumer.
     • The API Consumer updates their customer record.
8. When existing Customer:
   • The API Consumer updates the customer record accordingly.

When implementing Maya Mini App, your Mini App shall be able to utilize the Customer Access Token or the accessToken obtained from Maya through your session URL or acquired by refreshing the tokens , whichever is the most recent or valid value.

Once your application has acquired the Customer Access Token (accessToken) from Maya, you may proceed with the following steps.

Use the Get Profile via Maya Mini App endpoint to retrieve customer information from Maya. Information you are allowed to access will be defined within the scope of your client token, which is determined during onboarding.

A successful call to the Get Profile via Maya Mini App endpoint will return encrypted profile data. Subsequently, you shall decrypt the data using the JWE and JWK keys provided to you during onboarding.

Illustrated below is the specification of JWE and JWK keys.

JWE Private JWK:

{
  "kty": "<value>",
  "n": "<value>",
  "e": "<value>",
  "d": "<value>",
  "p": "<value>",
  "q": "<value>",
  "dp": "<value>",
  "dq": "<value>",
  "qi": "<value>"
}

JWS Secret JWK:

{
  "kty": "<value>",
  "k": "<value>"
}

How to use JWE and JWK keys

1. Import privateJwk using the algorithm RS512.
2. Import secretJwk using the algorithm HS256.
3. Decrypt the JWE token (value of data from the response) using privateJwk to get the JWS token.
4. Verify JWS token from the decrypted JWE token (from #3) using secretJwk to get the raw profile.

Sample Codes:

/**
 * Use node version 14
 * Install npm package jose
 *
 */

const { compactDecrypt, jwtVerify, importJWK } = require("jose");

const JWS_ALG = "HS256";
const JWE_KEY = <jwe_key>;
const JWS_KEY = <jws_key>;

const opToken = "<token>";


async function verifyOpToken(token) {
  try {
    // Import the JWE key
    const privateJwk = await importJWK(JWE_KEY);

    // Decrypt the JWE to get the JWS
    const decryptedJwe = await compactDecrypt(token, privateJwk);
    const decodedJwePayload = new TextDecoder().decode(decryptedJwe.plaintext);

    // Import the JWS key, verify the JWS and get the data
    const jwsSecretKey = await importJWK(JWS_KEY, JWS_ALG);
    const decryptedJws = await jwtVerify(decodedJwePayload, jwsSecretKey);
    console.log(decryptedJws);
  } catch (err) {
    console.log(err);
  }
}

verifyOpToken(opToken);
...

# Install library jwcrypto

#!/usr/bin/env python

import json
import sys
from jose import jwe, jwk, jws

def decrypt_and_verify_response(encrypted, private_jwk_str, secret_jwk_str):
  private_jwk = jwk.construct(json.loads(private_jwk_str), algorithm="RS512")
  secret_jwk = jwk.construct(json.loads(secret_jwk_str), algorithm="HS256")

  # decrypt jwe
  decrypted = jwe.decrypt(encrypted, key=private_jwk.to_dict()).decode('ascii')

  # decode and verify jws
  profile = json.loads(jws.verify(decrypted, key=secret_jwk, algorithms="HS256", verify=True))
  return profile

if __name__ == '__main__':
  args = sys.argv[1:]
  print(decrypt_and_verify_response(args[0], args[1], args[2]))

<?php
/* Install web-token/jwt-framework.
* Samples on how to import keys and load nested tokens.
* See the JWT Framework's official docs for more info.
*/

use Jose\Component\Core\JWK;
use Jose\Component\Core\AlgorithmManager;

use Jose\Component\Encryption\Algorithm\KeyEncryption\RSAOAEP;
use Jose\Component\Encryption\Algorithm\ContentEncryption\A256GCM;
use Jose\Component\Encryption\Compression\CompressionMethodManager;
use Jose\Component\Encryption\Compression\Deflate;
use Jose\Component\Encryption\JWEDecrypter;
use Jose\Component\Encryption\Serializer\JWESerializerManager;
use Jose\Component\Encryption\Serializer\CompactSerializer;

use Jose\Component\Signature\Algorithm\HS256;
use Jose\Component\Signature\JWSVerifier;
use Jose\Component\Signature\Serializer\JWSSerializerManager;
use Jose\Component\Signature\Serializer\CompactSerializer as SigCompactSerializer;


// OP Token
$token  = '<encrypted profile data>';

// Create keys
$jweKey = new JWK([<jwe_key>]);
$jwsKey = new JWK([<jws_key>]);

// Decrypt the JWE
$keyEncryptionAlgManager = new AlgorithmManager([ new RSAOAEP() ]);
$contentEncryptionAlgManager = new AlgorithmManager([ new A256GCM() ]);
$compressionMethodManager = new CompressionMethodManager([ new Deflate() ]);
$serializerManager = new JWESerializerManager([ new CompactSerializer() ]);

$jweDecrypter = new JWEDecrypter(
  $keyEncryptionAlgManager,
  $contentEncryptionAlgManager,
  $compressionMethodManager
);

$jwe = $serializerManager->unserialize($token);

// If error, will throw error
$isDecrypted = $jweDecrypter->decryptUsingKey($jwe, $jweKey, 0);
print_r($jwe->getPayload());


// Decrypt JWS
$jwsAlgManager = new AlgorithmManager([ new HS256() ]);
$jwsVerifier = new JWSVerifier( $jwsAlgManager );
$serializerManager = new JWSSerializerManager([ new SigCompactSerializer() ]);

$jws = $serializerManager->unserialize($jwe->getPayload());

// If error, will throw error
$isVerified = $jwsVerifier->verifyWithKey($jws, $jwsKey, 0);
print_r( $jws->getPayload());  // This is the decrypted profile data

Sample Raw Profile Data (after decrypt):

{
    "id": "a11938a3bcb675d92d7c1d0e4b71fee3f029",
    "profileId": "778307049099",
    "kycStatus": "KYC1",
    "workDetails": {
      "sourceOfIncome": "EMPLOYMENT",
      "sourceOfIncomeDetails": null,
      "natureOfWork": "OTHERS",
      "natureOfWorkDetails": "Others_Product",
      "verificationStatus": "PASSED"
    },
    "address": [
      {
        "line1": "6F Launchpad Bldg",
        "locality": "Brgy. Highway Hills",
        "city": "Mandaluyong",
        "country": "PH",
        "type": "PRESENT",
        "zipCode": "1234",
        "region": "Metro Manila",
        "verificationStatus": "PASSED"
      },
      {
        "line1": "6F Launchpad Bldg",
        "locality": "Brgy. Highway Hills",
        "city": "Metro Manila",
        "country": "PH",
        "type": "PERMANENT",
        "zipCode": "1234",
        "region": "Metro Manila",
        "verificationStatus": "PASSED"
      }
    ],
    "contact": [
      {
        "type": "MSISDN",
        "subtype": "PRIMARY",
        "value": "+639176712017",
        "verificationStatus": "PASSED"
      },
      {
        "type": "EMAIL",
        "subtype": "RECOVERY",
        "value": "mailto:[email protected]",
        "verificationStatus": null
      }
    ],
    "name": {
      "firstName": "Mose",
      "lastName": "Batz",
      "middleName": null,
      "verificationStatus": "PASSED"
    },
    "birthDetails": {
      "birthDate": "05-01-1980",
      "city": "Mandaluyong",
      "nationality": "PH",
      "country": "PH",
      "verificationStatus": "PASSED"
    }
  }