Scoped identity

Identity semantics

privateAppId is stable for one credential, normalized origin, and gate epoch. It changes across origins.

Do not reinterpret it

A private app ID is not anonymous, global, permanent, or transferable. Epoch rotation, credential replacement, and policy changes can deliberately change it.

Normalization

Deployed origins must use HTTPS. HTTP is accepted only for loopback development. Origins are lowercase, default ports are removed, and paths, queries, fragments, user info, wildcards, and opaque origins are rejected.