> For the complete documentation index, see [llms.txt](https://city-protocol.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://city-protocol.gitbook.io/docs/neofinance-as-a-service/wallet/security-considerations.md).

# Security Considerations

<table><thead><tr><th width="184.4296875">Constraint</th><th>Rationale</th></tr></thead><tbody><tr><td><strong>Keep <code>PRIVY_APP_SECRET</code> server-side only</strong></td><td>The app secret is used to authenticate your backend with Privy's verification infrastructure. Exposing it on the client would allow anyone to forge verification requests.</td></tr><tr><td><strong>Always send the identity token as <code>Authorization: Bearer &#x3C;identityToken></code></strong></td><td>This ensures the token travels in a standard header that your backend can extract and verify in a single step, and avoids leaking credentials in URL parameters or request bodies.</td></tr><tr><td><strong>Do not trust client-side wallet addresses directly</strong></td><td>A wallet address rendered in the browser is not proof of ownership. Only the identity token, verified server-side through <code>verifyPrivyWallet</code>, confirms that the session is authentic and the wallet is linked.</td></tr><tr><td><strong>Validate on every protected request</strong></td><td>Identity tokens are session-scoped. Your backend should call <code>verifyPrivyWallet</code> on each request to a protected endpoint rather than caching the result, ensuring revoked or expired sessions are rejected immediately.</td></tr></tbody></table>