> For the complete documentation index, see [llms.txt](https://docs.trover.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trover.tech/engineering/trover-privy-auth.md). # Trover production authentication checklist Public brand: **Trover**\ Production web domain: \*\* Privy production app ID: set through the deployment secret store ## What the code now does * Privy login offers X and wallet authentication. * The Account flow lets users create a user-owned embedded Ethereum wallet or link an existing wallet; it never receives a user's private key. * The only supported chain in the login UI is Robinhood Chain (`4663`). * The account page links the authenticated Privy user, X identity, and one canonical wallet. * Embedded wallets can be delegated to the agent. External wallets remain manual-signature wallets. * Users can independently disable all X actions, public mentions, or DMs. * The API accepts both bearer access tokens and Privy's `privy-token` HttpOnly cookie. * Tokens are checked against the configured app JWKS, with issuer `privy.io`, audience equal to the Privy app ID, and `ES256`. The verified Privy subject is then used for the authenticated Privy user lookup. ## Privy Dashboard 1. Use a separate Privy app for local/staging. Cookie-enabled production app IDs only work on their verified production domain. 2. In **App settings → Domains**, add these allowed web origins: * `https://trover.tech` * `https://www.trover.tech` if it will resolve to the same app 3. Set the cookie base domain to `trover.tech` (no protocol and no `www`). Apply every DNS record Privy shows, initially as DNS-only if Cloudflare is used, then wait for Privy to verify it. 4. Keep `SameSite=Strict` unless cross-site top-level navigation is required. If it is changed to Lax, audit every state-changing GET endpoint first. 5. Enable **Twitter/X** and **wallet** as login methods. For production branding and control, configure your own X OAuth credentials in Privy. X OAuth 1.0a requires X Basic tier or higher. The callback registered in the X developer app is: * `https://auth.privy.io/api/v1/oauth/callback` 6. Do not enable “Return OAuth tokens” unless Trover genuinely needs to act as the user. Current command processing does not: Privy X login proves identity, while the separate bot X app receives mentions/DMs and publishes replies. 7. Configure the appearance name, logo, privacy URL, and terms URL: * `https://trover.tech/legal/privacy` * `https://trover.tech/legal/terms` 8. Configure the production app's session lifetime and bot-traffic protection. Enable MFA if you later decide to require it for wallet actions. 9. Configure wallet delegation/authorization for the production app and verify that the server authorization key belongs to the intended wallet quorum. Never expose the app secret or authorization private key in `NEXT_PUBLIC_*` variables. 10. Configure the Privy webhook URL and copy its signing secret to the server: * `https://api.trover.tech/v1/privy/webhook` ## DNS and hosting * Point `trover.tech` (and optionally `www`) to the Next.js web deployment. * Point `api.trover.tech` to the Fastify API over HTTPS. * Ensure the API permits credentials and restricts CORS to the exact web origins. * Complete the Privy cookie DNS challenge before relying on server cookies. * Deploy with the public app ID baked into the Next.js build. Keep `PRIVY_APP_SECRET` server-only. ## Required environment values ```dotenv NEXT_PUBLIC_SITE_URL=https://trover.tech NEXT_PUBLIC_PRIVY_APP_ID= NEXT_PUBLIC_PRIVY_BASE_DOMAIN=https://privy.trover.tech NEXT_PUBLIC_API_URL=https://api.trover.tech WEB_ALLOWED_ORIGINS=https://trover.tech,https://www.trover.tech,https://dex.trover.tech PRIVY_APP_ID= PRIVY_APP_SECRET= PRIVY_JWKS_URL= PRIVY_AUTHORIZATION_KEY= PRIVY_WEBHOOK_SIGNING_KEY= ``` ## X command processing Privy login and the bot's X integration are separate configurations: 1. Privy links an X user ID to a Privy user and canonical wallet. 2. The bot X developer app delivers mentions and DMs to `https://api.trover.tech/v1/x/webhook`, with polling fallback. 3. The worker matches the incoming X author ID to the linked trading profile. 4. Commands are deduplicated, routed, and submitted using the wallet capability recorded for that profile. 5. The user can disable the relevant channel from `/account`; environment hard stops still override those settings. For the bot X app, configure the production callback/webhook URL, OAuth 1.0a credentials for account activity where available, OAuth 2.0 user token/refresh token for v2 posting and DMs, the webhook secret, bot user ID/username, and read/write/DM scopes needed by the enabled capabilities. Rotate every credential that has appeared in a prompt, attachment, log, or repository history. ## Release checks * Sign in with X on `trover.tech` and confirm `privy-token` is HttpOnly, Secure, and scoped to the configured base domain. * Sign in with an external wallet and confirm SIWE completes. * Sign in with X only and confirm an embedded Robinhood Chain wallet is created. * Link X plus wallet, enable X actions, refresh the page, and confirm the profile persists. * Toggle mentions and DMs separately and verify the API state. * Send one test mention from the linked X account and confirm the author ID matches the stored profile. * Confirm an unlinked X account cannot use another user's wallet. * Revoke/logout and confirm subsequent protected API calls return 401/404 without changing state. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.trover.tech/engineering/trover-privy-auth.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.