Skip to content

OAuth

Verify a launch URL

Confirms that the larm_* parameters your launch URL received were issued by LARM for your app just now.

POST/oauth/launch/verify

Send the parameters exactly as received. The URL is valid for 5 minutes, and LARM does not store larm_nonce, so reject repeats yourself. See App launch for details.

Request body

larm_store_idstring (uuid)required
larm_installation_idstring (uuid)
larm_intentobjectrequired: install open
larm_issued_atstringrequired
larm_noncestringrequired
larm_signaturestringrequired

Response

validobject
store_idstring (uuid)
installation_idstring | null (uuid)
intentobject: install open
issued_atinteger

Errors

HTTP	Code	Meaning
400	`INVALID_LAUNCH`	Missing or extra keys.
401	`LAUNCH_EXPIRED`	More than 5 minutes have passed.
401	`LAUNCH_SIGNATURE_INVALID`	The signature does not match.
401	`INSTALLATION_INACTIVE`	The installation is not active.

Shared codes are listed in Errors.

Request

cURL

curl -X POST "https://larm.sa/oauth/launch/verify" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{ "larm_store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10", "larm_installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d", "larm_intent": "open", "larm_issued_at": "1792060800", "larm_nonce": "Vx3mQ0aT9kLz2pR8sN4wYb1c", "larm_signature": "8m2Kq…" }'

Node.js

const response = await fetch(`https://larm.sa/oauth/launch/verify`, {
  method: 'POST',
  headers: {
    Authorization: 'Basic ' + Buffer.from(`${process.env.CLIENT_ID}:${process.env.CLIENT_SECRET}`).toString('base64'),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "larm_store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
    "larm_installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
    "larm_intent": "open",
    "larm_issued_at": "1792060800",
    "larm_nonce": "Vx3mQ0aT9kLz2pR8sN4wYb1c",
    "larm_signature": "8m2Kq…"
  }),
})
if (!response.ok) throw new Error((await response.json()).error.code)
const { data, meta } = await response.json()

Python

import requests

response = requests.post(
    f"https://larm.sa/oauth/launch/verify",
    auth=(CLIENT_ID, CLIENT_SECRET),
    json={
      "larm_store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
      "larm_installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
      "larm_intent": "open",
      "larm_issued_at": "1792060800",
      "larm_nonce": "Vx3mQ0aT9kLz2pR8sN4wYb1c",
      "larm_signature": "8m2Kq…"
    },
    timeout=15,
)
response.raise_for_status()
data = response.json()["data"]

PHP

$ch = curl_init("https://larm.sa/oauth/launch/verify");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_USERPWD => "$clientId:$clientSecret",
  CURLOPT_POSTFIELDS => json_encode([
    "larm_store_id" => "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
    "larm_installation_id" => "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
    "larm_intent" => "open",
    "larm_issued_at" => "1792060800",
    "larm_nonce" => "Vx3mQ0aT9kLz2pR8sN4wYb1c",
    "larm_signature" => "8m2Kq…"
  ]),
]);
$data = json_decode(curl_exec($ch), true)['data'];

Response 200

JSON

{
  "valid": true,
  "store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
  "installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
  "intent": "open",
  "issued_at": 1792060800
}