> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/release-and-readiness/privy-production-activation.md).

# Privy production activation

This runbook activates customer identity only. It does not authorize trading, wallet signatures, deposits, transfers, withdrawals, operator access or Agent Pro.

## 1. Configure the operator-owned production app

1. Create a production Privy app distinct from every development app.
2. Enable Google and wallet login. Configure NIGHTSHIFT-owned Google OAuth branding, reviewed Terms and Privacy URLs, and do not return OAuth provider tokens to the browser.
3. Enable identity tokens under the dashboard's advanced authentication settings.
4. Allow exactly `https://nytshift.xyz` and `https://www.nytshift.xyz`. Do not add localhost, preview hosts or broad wildcards to the production app.
5. Enable first-party HttpOnly cookies for `nytshift.xyz`, publish the exact DNS record Privy requests, wait for verification and retain `SameSite=Strict`.
6. If a Privy server IP allowlist is enabled, include the VPS's reviewed stable egress before enforcing it.

Place `NEXT_PUBLIC_PRIVY_APP_ID`, optional public client/WalletConnect identifiers and server-only `PRIVY_APP_SECRET` in the private build/service environment. `PRIVY_JWT_VERIFICATION_KEY` is optional public verification material. Never place the app secret, access token or identity token in source, `config.json`, a checklist, a prompt, logs or browser persistence.

## 2. Rebuild and exercise the exact public origin

Rebuild and deploy an exact immutable release because `NEXT_PUBLIC_` identifiers are compile inputs. Keep `EXECUTION_MODE=disabled`, `ARCUS_EXECUTION_MODE=disabled`, `ALLOW_MAINNET=false` and `ARCUS_ALLOW_MAINNET=false`.

At both 1280px and 390px on `https://nytshift.xyz`, complete every check below with production DevTools open:

* Google login and logout;
* EVM-wallet login and logout;
* identity-token-backed private profile read;
* first-party HttpOnly access and identity cookies after DNS verification;
* social user receives one embedded EVM wallet only when no wallet already exists;
* wallet-first user does not receive a duplicate embedded wallet;
* external wallet link appears only after the refreshed identity token;
* access-token refresh, session revalidation and expired-session failure;
* an unallowlisted origin is rejected;
* a wallet on another chain remains visibly wrong-chain until the user explicitly switches to `4663`;
* no CSP violation, console warning/error, page error or horizontal overflow.

Verify throughout that login leaves execution, funding, withdrawal, transfer, operator and Agent Pro controls locked.

## 3. Create the retained rehearsal evidence

Create a checklist outside the repository. `observedAtMs` is the completion time and `expiresAtMs` must be later but no more than 30 days later. Set a check to `true` only after observing it on the exact production app and origin.

```json
{
  "environment": "production",
  "origin": "https://nytshift.xyz",
  "allowedOrigins": ["https://nytshift.xyz", "https://www.nytshift.xyz"],
  "cookieDomain": "nytshift.xyz",
  "chainId": 4663,
  "embeddedWalletPolicy": "users-without-wallets",
  "observedAtMs": 0,
  "expiresAtMs": 0,
  "checks": {
    "allowedOriginsVerified": true,
    "cookieDnsVerified": true,
    "cspNoViolations": true,
    "desktop1280": true,
    "embeddedWalletForUsersWithoutWallets": true,
    "externalWalletLink": true,
    "googleLogin": true,
    "googleOAuthBranding": true,
    "httpOnlyCookies": true,
    "identityTokens": true,
    "logout": true,
    "mobile390": true,
    "robinhoodChainSwitch": true,
    "sessionRefreshAndExpiry": true,
    "termsAndPrivacyReviewed": true,
    "walletLogin": true,
    "walletUserNoDuplicateEmbeddedWallet": true,
    "wrongChainDetected": true,
    "wrongOriginRejected": true,
    "zeroConsoleErrors": true
  }
}
```

The zero timestamps above are structural placeholders and will be rejected. Replace them with the actual millisecond timestamps from the completed rehearsal.

With the exact public app ID present in the command environment, create and verify an absolute private output path:

```powershell
pnpm identity:evidence -- create --input C:\operator\privy-checklist.json --output C:\operator\privy-production-evidence.json
pnpm identity:evidence -- verify --evidence C:\operator\privy-production-evidence.json
```

On Linux, keep the file owned by the service identity with mode `0600`. Configure `NIGHTSHIFT_PRIVY_PRODUCTION_EVIDENCE_PATH` in the private service environment, restart the exact release and remove the disposable checklist. The retained evidence contains only booleans, timestamps, fixed production scope, an app-ID hash and a digest.

## 4. Read back the gate

`/api/health` must report:

* `identityBrowserState=configured`;
* `identityServerState=configured`;
* `identityProductionEvidenceState=verified` with a future expiry;
* both login booleans `true` and embedded policy `users-without-wallets`;
* status `ok`, both execution modes `disabled` and both mainnet flags `false`.

Then run:

```powershell
pnpm activation:audit --origin https://nytshift.xyz
```

Customer access may become ready; capital authority must remain `not-proven`.

## Rotation and incident response

* Rotate to a new evidence file after any app ID, allowed-origin, cookie-domain, identity-token, login-method, OAuth, CSP or wallet-policy change, and at least every 30 days.
* App-ID rotation immediately creates `PRIVY_PRODUCTION_EVIDENCE_APP_MISMATCH` until the new app is rehearsed.
* Expiry creates action-required without preserving a stale ready claim.
* Malformed, tampered, symlinked, oversized or publicly readable Unix evidence makes health unsafe. Restore the prior reviewed file or remove the path; never edit a digest by hand.
* On suspected token or app-secret compromise, revoke/rotate it in Privy first, stop customer access if necessary, invalidate the evidence and repeat the entire rehearsal.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/release-and-readiness/privy-production-activation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.