> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neus.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security best practices for NEUS SDK integrations.

## Auth by operation

| Operation | Auth |
| - | - |
| `POST /api/v1/verification` | Signed standard string, or advanced server path with access key + `X-Neus-App` |
| `GET /api/v1/proofs/{qHash}` | Public metadata for public/unlisted; private needs owner rules |
| Private payload reads | Owner signature / SDK helpers |

## Do Not

<Warning>
  * Do not treat proof signatures as bearer tokens (they are request-bound)
  * Do not embed **secrets** in browser bundles
  * Do not call the NEUS API from browser JavaScript with hand-written `fetch` and custom headers; use SDK or Hosted Verify, or **proxy** through your server
  * Do not log or persist:
  * proof signatures
  * API keys
  * third-party auth credentials or provider tokens
</Warning>

## Defaults

`client.verify()` defaults **private**. `VerifyGate` uses Hosted Verify with the published gate policy. [Privacy](../platform/security-and-trust)

If you need proof reuse without owner-authenticated access, opt into unlisted public explicitly:

```javascript theme={"dark"}
const proofOptions = {
  privacyLevel: 'public',
  publicDisplay: false,
};
```

Do not treat unlisted public proofs as secret.

| Control | Purpose |
| - | - |
| `privacyLevel` | Default private; switch to public only for intentional public reuse |
| `publicDisplay` | Discovery vs unlisted |
| `storeOriginalContent` | Advanced storage control |

<Note>
  Unlisted public proofs are still public to anyone with the `qHash`.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.