apps/wallet demonstrates balances, rewards, activity, and profile data while
keeping the merchant API key and OIDC access token out of browser JavaScript.
The default docker compose up --build starts a visibly synthetic preview at
http://127.0.0.1:3230/. WALLET_DEMO=true never calls the customer API and
must not be presented as a live account.
Production flow
- The BFF creates bounded state, nonce, and PKCE verifier records.
- OIDC Authorization Code + PKCE runs against the configured issuer.
- The callback verifies the ID-token signature, issuer, audience, nonce, and time.
- The access token stays server-side behind an
HttpOnly, Secure, SameSite=Lax cookie.
- Same-origin and CSRF checks protect customer-data writes.
The reference session store is process memory. Multi-instance deployments must
replace it with an encrypted, expiring shared store while preserving the same
cookie and CSRF contract.
