如何高效集成Onfido身份验证服务？onfido/onfido-php助你轻松搞定！

<pre class="brush:php;toolbar:false;">{
  "repositories": [
    {
      "type": "vcs",
      "url": "https://github.com/onfido/onfido-php.git"
    }
  ],
  "require": {
    "onfido/onfido-php": "*@dev"
  }
}

<pre class="brush:php;toolbar:false;"><?php
require_once(__DIR__ . '/vendor/autoload.php');

use Onfido\Configuration;
use Onfido\Region;
use Onfido\Api\DefaultApi;
use GuzzleHttp\Client;
use Onfido\Model\ApplicantBuilder;
use Onfido\ApiException;
use Onfido\WebhookEventVerifier;
use Onfido\OnfidoInvalidSignatureError;

// 1. 配置Onfido客户端
$configuration = Configuration::getDefaultConfiguration();
$configuration->setApiToken(getenv('ONFIDO_API_TOKEN')); // 从环境变量获取API Token
$configuration->setRegion(Region::EU); // 根据你的业务区域选择，支持 EU, US, CA

// 2. 初始化API客户端，并配置HTTP客户端（如Guzzle）
$onfidoApi = new DefaultApi(
    new Client([
        'timeout'         => 30,
        'connect_timeout' => 30,
        'read_timeout'    => 30
    ]),
    $configuration
);

// 3. 示例：创建一个新的申请人
try {
    $applicant = $onfidoApi->createApplicant(
        new ApplicantBuilder([
            'first_name' => 'John',
            'last_name'  => 'Doe'
        ])
    );

    echo "成功创建申请人，ID: " . $applicant->getId() . "\n";
    echo "申请人姓名: " . $applicant->getFirstName() . " " . $applicant->getLastName() . "\n";

    // 接下来可以上传文档、创建检查等...
    // 例如：$document = $onfidoApi->uploadDocument(...);
    // 例如：$check = $onfidoApi->createCheck(...);

} catch (ApiException $ex) {
    // 捕获并处理Onfido API返回的异常
    echo '捕获到API异常: ',  $ex->getMessage(), "\n";
    // 可以在这里记录日志或向用户显示友好的错误信息
}
?>

<pre class="brush:php;toolbar:false;"><?php
// ... 前面的 require_once 和 use 声明 ...

// 假设这是从HTTP请求体中获取到的原始Webhook payload
$rawPayload = '{"payload":{"resource_type":"check","action":"check_completed","object":{"id":"abc-123","status":"complete"}}}';
// 假设这是从HTTP请求头中获取到的Onfido-Signature
$signature = 'a0...760e'; // 这是一个示例签名，实际应从请求头获取

try {
    $verifier = new WebhookEventVerifier(getenv('ONFIDO_WEBHOOK_SECRET_TOKEN')); // 使用你的Webhook Secret Token
    $event = $verifier->readPayload($rawPayload, $signature);

    echo "Webhook事件已成功验证并解析：\n";
    echo "资源类型: " . $event->getPayload()->getResourceType() . "\n";
    echo "事件动作: " . $event->getPayload()->getAction() . "\n";
    // 根据事件类型处理业务逻辑...

} catch (OnfidoInvalidSignatureError $ex) {
    // 签名无效，可能是伪造的请求，应拒绝处理
    echo 'Webhook签名无效: ',  $ex->getMessage(), "\n";
    http_response_code(403); // 返回403 Forbidden
} catch (Exception $ex) {
    // 其他错误处理
    echo '处理Webhook时发生错误: ',  $ex->getMessage(), "\n";
    http_response_code(500);
}
?>