VERNOfor developers

Verno developer platform — quick start

Build an app that Vernolink people can add from Discover, sign in with Verno, chat with your bot inside your app, and get business messages from you in their Messages. Everything starts in test mode with pretend test users; real people only see your app after Verno reviews it and your account is allowed live (after the developer terms).

  1. Go to the developer website (developers.verno.co.in) and sign up with your email as your ID, a password (at least 10 characters, not a common one) and your business name. Your email is not verified yet, so the account stays in test mode. Next time, sign in with the same email and password. You can change the password in the portal; after 5 wrong passwords sign-in pauses for 15 minutes.
  2. In the Vernolink app, make a developer link code (POST /api/v1/link/dev/link-code) and type it on the portal. Your developer account is now linked to that one Vernolink account. Verno never shows your phone number on the portal.
  3. Your business name (shown as "Made by …") can be changed in the portal. Add teammates under People as manager (apps, keys, webhooks) or staff (read, test users).

2. Create an app

Name, category, a privacy policy link (https), the domains your app runs on (https only), the app start address, sign-in return addresses (on your domains), who can find it (public = listed in Discover after review; private = your staff and people with your invite code) and the permissions you ask people for: profile (Verno name and photo), chat (messages in the chat they start in your app), location (only when they allow it at that moment). There is no permission for phone numbers, contacts, other chats or anyone's vault. Every link is checked for piracy and adult content before it can be saved; unsure links are looked at by a person during review.

3. Test mode

curl https://verno.co.in/v1/me -H "Authorization: Bearer vk_test_..."

4. Webhooks

Set an https webhook address; the signing secret is shown once. Every delivery is a JSON POST with Verno-Event, Verno-Delivery, Verno-Timestamp and Verno-Signature: v1=<hex>. Check it:

import hashlib, hmac, time

def verified(secret: str, ts: str, signature: str, body: bytes) -> bool:
    if abs(time.time() - int(ts)) > 300:          # refuse replays older than 5 minutes
        return False
    want = "v1=" + hmac.new(secret.encode(), ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(want, s.strip()) for s in signature.split(","))
const crypto = require("crypto");
function verified(secret, ts, signature, rawBody) {
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const want = "v1=" + crypto.createHmac("sha256", secret).update(ts + "." + rawBody).digest("hex");
  return signature.split(",").some(s => s.trim().length === want.length &&
    crypto.timingSafeEqual(Buffer.from(s.trim()), Buffer.from(want)));
}

Answer 2xx quickly. Anything else is retried after 1 min, 5 min, 30 min, 2 h and 12 h, then marked failed (you can send it again from the delivery log). Use Verno-Delivery to ignore duplicates.

5. Sign in with Verno (OAuth 2 + PKCE)

  1. Make a code_verifier (43-128 characters) and code_challenge = BASE64URL(SHA256(verifier)).
  2. Send the person to the consent screen with client_id, redirect_uri (registered exactly), scope (e.g. profile chat), state, code_challenge, code_challenge_method=S256.
  3. You get ?code=...&state=... on your return address. Exchange it within 5 minutes, once:
curl -X POST https://verno.co.in/v1/oauth/token -d grant_type=authorization_code -d client_id=va_... \
  -d code=vc_... -d code_verifier=... -d redirect_uri=https://shop.example.in/callback
  1. GET /v1/oauth/userinfo with the access token gives user_id (your app's own id for this person; a different app gets a different id) and, with profile, name and photo. Never a phone number.

6. Going live

Send the app for review. Verno checks the content policy (no gambling, lotteries or betting, loans, unlicensed money schemes, MLM, adult content, piracy, fake reviews, imitating Verno or another brand), the privacy policy and the links. After approval and once Verno allows your account live, make a live key. Each approval is saved as a version; you can roll back to an earlier approved version at any time. Verno can switch an app off at once.

7. Messages: two kinds

Full reference: API.md.