# Server Callback

Privy sends the verified result to the merchant `callback_url` that Privy
configures during provisioning. The callback is one of the two delivery
channels for the verified JWT.

The body contains the same Privy-signed JWT that the exchange endpoint returns:

```json
{
  "session_id": "9f1c2c8a-2d6f-4d60-9ab1-85a5d4aa93d0",
  "event": "identity.verified",
  "token": "eyJ..."
}
```

> Verify the JWT before you use the result. See
> [Verify the JWT](/digital-id/guides/verify-jwt). The JWT signature
> authenticates the payload. The public API contract defines no other
> transport-level authentication for the callback request.

## Receiver contract

| Aspect | Contract |
| --- | --- |
| Response window | The maximum response time is 60 seconds. Privy can treat a later response as timed out. |
| Acknowledgement | Acknowledge the callback promptly. Run long business processes asynchronously, after the acknowledgement. |
| Verification | Verify the JWT before you use the result. |
| Idempotency | The same verified result can also arrive through the exchange endpoint. Make processing idempotent with `session_id`, so that you process a result from both channels only once. |
| Delivery guarantees | The public API contract does not guarantee retries, delivery order, or exactly-once delivery. Design the receiver to tolerate a missed or repeated delivery. The exchange flow gives the result independently. |