igrantio-issuer-backendlisted

# iGrant.io issuer backend (OpenID4VCI) ## When to use Build or extend the server that an **issuer** frontend talks to. It composes three building blocks for the issuance flow only (least privilege): `igrantio-backend-proxy` + `igrantio-backend-webhooks` + `igrantio-backend-sse`. For the verifier equivalent use `igrantio-verifier-backend` (separate skill). Read `igrantio-ows-overview` first for the API and architecture. **Before you build**: run the integrator intake in `igrantio-ows-overview` - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each. ## What it does - **Proxy** `GET|POST|PUT ${PROXY_PREFIX}/{tenant}/...` → OWS, injecting the tenant's `ApiKey`. Allow-lists only OWS **credential** endpoints (issue, history). - **Register** the issuer webhook idempotently (`ISSUER_TOPICS`) via `scripts/register-webhook.ts`. - **Receive** `POST /webhook`, verify the `X-iGrant-Signature` HMAC, extract the `CredentialExchangeId`, store the event. - **SSE** `GET /webhook/sse/{CredentialExchangeId}` streams the event to the browser; `DELETE /webhook/{id}` lets it consume-and-delete. ## Reference implementation Runnable Express + TypeScript app in [`./references`](./references): ``` references/ src/config.ts env config src/tenants.ts TenantStore - per-tenant API-key resolution (env or pluggable) src/eventStore.ts in-memory event store (swap for Redis/Postgres) src/topics.ts