> For the complete documentation index, see [llms.txt](https://city-protocol.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://city-protocol.gitbook.io/docs/software-development-kit/wallet/backend-verification.md).

# Backend Verification

#### verifyPrivyWallet

The SDK exposes a single async helper that validates the incoming identity token against Privy's API and returns the resolved user object.

```
import { verifyPrivyWallet } from "@cityprotocol/core";

const user = await verifyPrivyWallet({
  appId: process.env.PRIVY_APP_ID!,
  appSecret: process.env.PRIVY_APP_SECRET!,
  authorizationHeader: request.headers.get("authorization"),
});

console.log(user.id);             // Privy user ID
console.log(user.wallet?.address); // Verified wallet address
```

#### **Parameters:**

<table><thead><tr><th width="193.765625">Parameter</th><th width="144.51171875">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>appId</code></td><td><code>string</code></td><td>Your Privy App ID (server-side copy)</td></tr><tr><td><code>appSecret</code></td><td><code>string</code></td><td>Your Privy App Secret — never expose to the client</td></tr><tr><td><code>authorizationHeader</code></td><td><code>string</code></td><td>The raw <code>Authorization</code> header value (<code>Bearer &#x3C;identityToken></code>)</td></tr></tbody></table>

#### **Return value:**

The resolved user object includes `id` (the Privy user identifier) and `wallet.address` (the EVM address linked to the session). If the token is invalid or expired, the call will throw.