Guides
Server Callback
Privy sends the verified result to the merchant callback_url that Privy
configures during provisioning. The callback is one of the two delivery
channels for the verified JWT.
The body contains the same Privy-signed JWT that the exchange endpoint returns:
Code
Verify the JWT before you use the result. See Verify the JWT. The JWT signature authenticates the payload. The public API contract defines no other transport-level authentication for the callback request.
Receiver contract
| Aspect | Contract |
|---|---|
| Response window | The maximum response time is 60 seconds. Privy can treat a later response as timed out. |
| Acknowledgement | Acknowledge the callback promptly. Run long business processes asynchronously, after the acknowledgement. |
| Verification | Verify the JWT before you use the result. |
| Idempotency | The same verified result can also arrive through the exchange endpoint. Make processing idempotent with session_id, so that you process a result from both channels only once. |
| Delivery guarantees | The public API contract does not guarantee retries, delivery order, or exactly-once delivery. Design the receiver to tolerate a missed or repeated delivery. The exchange flow gives the result independently. |
Last modified on