VerseBill

Authentication

How users authenticate with Privy and how the server verifies them.

VerseBill uses Privy for authentication and embedded wallets. The server verifies a Privy-issued access token on every authenticated request and loads the matching user and merchant records.

How it works

  • The client signs in with Privy and receives an access token
  • The token is sent with API requests (Bearer header or privy-token cookie)
  • The server verifies the token with the Privy client
  • The verified user ID is matched to a User and Merchant in Postgres
The server trusts only the verified Privy token and the database. The client cannot be trusted to assert its own identity, wallet address, or payment state.

Privy also supports HttpOnly cookie sessions via PRIVY_USE_HTTPONLY_COOKIES; the middleware refreshes expired access tokens through a /refresh route.

PreviousArchitectureNextDatabase
Authentication — VerseBill Documentation