Skip to content
YellowParrot ABDM DevKit

Callback bridge

You only need this when you connect to ABDM’s test system or production. The practice ABDM does not need it.

Why it exists. ABDM replies later, by calling a public web address you give it (“the patient approved”, “here are the records”). It expects an immediate 202 Accepted, and it never resends a reply that was missed. Your laptop has no public address, and a busy server can miss a message. The bridge is a small service you host on Cloudflare that catches every reply and keeps it until the DevKit collects it.

202ABDMsends consent andrecord resultsCallback bridgeyour own Cloudflare Worker1 Check it really came from ABDM2 Ignore repeats and old messages3 Store it safely, then reply 202DevKitcollects from thebridge's inbox
ABDM never resends a lost message, so the bridge stores every result before answering.
  • It checks every message really came from ABDM (ABDM signs its messages). This also blocks fake record deliveries.
  • It ignores repeats and old messages, remembering every message for a day even after it is collected, so a replayed message cannot change anything.
  • It stores first, answers second, so nothing is lost if the DevKit is busy or offline.
  • The DevKit pulls from the bridge with its own password, so the DevKit can run anywhere, even on a laptop.

Set it up

Section titled “Set it up”

You need a Cloudflare account (the free plan is enough) and its wrangler command-line tool.

  1. Go to the bridge folder and copy the example settings:

    Terminal window
    cd apps/callback-bridge
    cp wrangler.toml.example wrangler.toml

  2. Create the database (Cloudflare’s D1, included in the free plan) and its table:

    Terminal window
    wrangler d1 create abdm-callbacks
    wrangler d1 execute abdm-callbacks --remote --file schema.sql

    Paste the database ID it prints into wrangler.toml.

  3. Set the password the DevKit will use to collect messages:

    Terminal window
    wrangler secret put INBOX_TOKEN

  4. Add the address of ABDM’s public signing keys (ABDM_JWKS_URL) and the name ABDM signs as (ABDM_ISSUER) to wrangler.toml, then deploy:

    Terminal window
    wrangler deploy

The bridge refuses all traffic until the signing-key address, the signer’s name and the password are all set. The exact values for ABDM’s V3 APIs are still being confirmed in ABDM’s test system.