> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth Provider Setup

> Connect Dynamic or Privy to your SIS environment.

Connect your auth provider — Dynamic or Privy — for embedded wallets and authentication. You configure one provider per environment. Once active, SIS will validate JWTs issued by that provider for requests made against that environment.

<Tabs>
  <Tab title="Dynamic">
    ## Dynamic

    Dynamic issues JWTs scoped to an **environment**. Each of your SIS environments should use the credentials from the matching Dynamic environment.

    ### Required credentials

    | Field            | Description                                      |
    | ---------------- | ------------------------------------------------ |
    | Environment ID   | The Dynamic environment ID (e.g. `abc123-...`)   |
    | Public Key (JWK) | The JWK public key used to verify JWT signatures |

    ### Where to find them

    1. Open the [Dynamic dashboard](https://app.dynamic.xyz) and select your project
    2. Go to **Configurations → Environments** and select the environment you want to connect
    3. The **Environment ID** is shown at the top of the environment settings
    4. Under **Security**, find the **Public key** section — copy the JWK value

    <Note>
      Dynamic environments map 1:1 with SIS environments. Use the development Dynamic environment credentials for your SIS development environment, staging for staging, and so on.
    </Note>

    ### Activating

    Enter both values in **Environment → Authentication → Dynamic**, then toggle **Active**. SIS will immediately start validating Dynamic-issued JWTs for this environment.
  </Tab>

  <Tab title="Privy">
    ## Privy

    Privy provides embedded wallets and user authentication tied to an **App ID**. You can connect a Privy app in three ways — pick the one that matches how your Privy deployment is set up.

    ### App ID only (recommended)

    The simplest setup. Provide just your App ID and SIS will verify incoming Privy JWTs against Privy's hosted JWKS endpoint. Choose this if you're using a standard Privy app and don't need to pin to a specific signing key.

    #### Required credentials

    | Field  | Description               |
    | ------ | ------------------------- |
    | App ID | Your Privy application ID |

    #### Where to find it

    1. Open the [Privy console](https://console.privy.io) and select your app
    2. The **App ID** is shown in **Settings → App Info**

    <Note>
      This mode relies on Privy **identity tokens**, which carry user claims (wallets, email) directly in the JWT. Enable **Return user data in an identity token** in your Privy console under **User management → Authentication → Advanced**, then read the token client-side using Privy's [`useIdentityToken`](https://docs.privy.io/authentication/user-authentication/access-tokens) hook (or `getIdentityToken()` from the headless SDK) — the default `getAccessToken()` returns a Privy access token, which carries no user claims and will fail Sumvin verification in App ID only mode.
    </Note>

    #### Reading the identity token in React

    ```tsx theme={null}
    import { useIdentityToken } from "@privy-io/react-auth";

    export function ApiCaller() {
      const { identityToken } = useIdentityToken();

      async function fetchMe() {
        if (!identityToken) return;
        await fetch("https://api.sumvin.com/v0/user/me", {
          headers: {
            "x-juno-jwt": identityToken,
            "x-juno-orgid": "org-...:env-...",
          },
        });
      }

      return <button onClick={fetchMe}>Fetch me</button>;
    }
    ```

    See the [Privy authentication guide](https://docs.privy.io/authentication/user-authentication/overview) for setup details and access-token vs identity-token semantics.

    ### App ID and verification key

    Use this if you want SIS to verify JWTs against a specific public key rather than Privy's hosted JWKS — for example, if your Privy deployment uses a custom signing key, or you want to pin verification to a key you control.

    #### Required credentials

    | Field            | Description                                                        |
    | ---------------- | ------------------------------------------------------------------ |
    | App ID           | Your Privy application ID                                          |
    | Verification Key | PEM-formatted public key or JWK JSON used to verify JWT signatures |

    #### Where to find them

    1. Open the [Privy console](https://console.privy.io) and select your app
    2. The **App ID** is shown in **Settings → App Info**
    3. The **Verification Key** is under **Authentication → JWT verification** — copy either the PEM public key or the JWK value

    ### App ID and App Secret

    Use this if you need SIS to call Privy's REST API on your behalf to fetch extended user data — such as terms acceptance or account creation timestamps — that isn't carried in the JWT itself. Most integrations don't need this.

    #### Required credentials

    | Field      | Description                                                      |
    | ---------- | ---------------------------------------------------------------- |
    | App ID     | Your Privy application ID                                        |
    | App Secret | The API key used to authenticate server-to-server calls to Privy |

    #### Where to find them

    1. Open the [Privy console](https://console.privy.io) and select your app
    2. The **App ID** is shown in **Settings → App Info**
    3. Under **Settings → API keys**, generate or copy an **App Secret**. Treat this value like a password — it grants server-to-server access to your Privy app

    ### Activating

    Enter the credentials for your chosen setup in **Environment → Authentication → Privy**, then toggle **Active**. SIS will immediately start validating Privy-issued JWTs for this environment.
  </Tab>
</Tabs>

## Activating and Switching Providers

* **Activating** — toggle **Active** on the configured provider. Only one provider can be active per environment at a time.
* **Switching providers** — configure the new provider first, verify credentials, then deactivate the current provider and activate the new one. This avoids a gap in auth coverage.
* **Deactivating** — toggle **Active** off. SIS will reject all JWTs for this environment until a provider is re-activated.

## Related

* [Authentication Model](/dashboard/authentication-model) — how SIS uses these credentials to validate JWTs
* [Environments](/dashboard/environments) — creating and managing environments