> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neobank.proofof.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS and origins

> Enforce exact application, Perflo, and Vault origins in live and production runtimes.

# Configure TLS and exact origins

Origin validation prevents provider credentials and approval sessions from being sent to an unreviewed service. Live mode therefore pins every Perflo service, including its path, and production requires HTTPS for application and Vault traffic.

## Use reviewed Perflo origins

Set:

```dotenv theme={null}
NEOBANK_PERFLO_APP_URL=https://app.perflo.ai
NEOBANK_PERFLO_PERFOLIO_URL=https://api.perfolio.ai/api
NEOBANK_PERFLO_FIAT_URL=https://api-fiat.perfolio.ai/api
NEOBANK_PERFLO_CARDS_URL=https://api-cards.perfolio.ai
NEOBANK_PERFLO_AGENT_URL=https://agent-mode-backend-prod-merge.up.railway.app
```

The validator rejects changes to scheme, host, port, user information, or base path. Hosted connection, approval, Know Your Customer, and card reveal URLs receive the same exact-origin validation before the browser sees them.

## Protect application origins

Production requires HTTPS `NEOBANK_PUBLIC_ORIGIN` and `NEOBANK_API_ORIGIN`. The single-server deployment uses one origin behind Caddy. Cross-site request forgery protection also checks the exact origin on unsafe cookie-authenticated requests.

Loopback live development can use HTTP application origins only when debug authentication is explicitly enabled. This exception does not apply to Perflo service origins.

## Protect Vault traffic

Production requires an HTTPS `NEOBANK_VAULT_ADDR`. The server Compose path runs Vault with a certificate for `vault` and mounts its CA into every Python workload. Cleartext Vault transport is rejected because provider access and refresh credentials pass through the Transit API.