I'm working on a project that integrates with a third-party service via API, and the third-party uses callbacks to update us on the status of the operations being performed. These callbacks can be hit up to a day after the original method call as we're dealing with complex financial operations.
I need a way to authenticate incoming callbacks from the third-party service, but their portal does not support auth or any custom params other than the URL. Furthermore, the callback URL is defined through a GUI portal that they've provided, which means I can't dynamically pass a token in the callback URL and check for it.
The only option that I'm currently aware of is creating an isolated microservice that whitelist the third party's domain, accepts their calls, appends the auth, and forwards the newly-authenticated calls to our server. We use Laravel for our backend, so I was thinking of deploying a Lumen microservice to handle this.
- What is the best design for authenticating callbacks like this?
- Is there a specific technology that is useful to this use case? E.g. would a serverless function be well-suited for this?