# Security Considerations

<table><thead><tr><th width="184.4296875">Constraint</th><th>Rationale</th></tr></thead><tbody><tr><td><strong>Keep <code>PRIVY_APP_SECRET</code> server-side only</strong></td><td>The app secret is used to authenticate your backend with Privy's verification infrastructure. Exposing it on the client would allow anyone to forge verification requests.</td></tr><tr><td><strong>Always send the identity token as <code>Authorization: Bearer &#x3C;identityToken></code></strong></td><td>This ensures the token travels in a standard header that your backend can extract and verify in a single step, and avoids leaking credentials in URL parameters or request bodies.</td></tr><tr><td><strong>Do not trust client-side wallet addresses directly</strong></td><td>A wallet address rendered in the browser is not proof of ownership. Only the identity token, verified server-side through <code>verifyPrivyWallet</code>, confirms that the session is authentic and the wallet is linked.</td></tr><tr><td><strong>Validate on every protected request</strong></td><td>Identity tokens are session-scoped. Your backend should call <code>verifyPrivyWallet</code> on each request to a protected endpoint rather than caching the result, ensuring revoked or expired sessions are rejected immediately.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://city-protocol.gitbook.io/docs/neofinance-as-a-service/wallet/security-considerations.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.