diff --git a/world-id/idkit/integrate.mdx b/world-id/idkit/integrate.mdx
index 1b98939..5678f2e 100644
--- a/world-id/idkit/integrate.mdx
+++ b/world-id/idkit/integrate.mdx
@@ -323,12 +323,25 @@ export async function POST(request: Request): Promise<Response> {
     idkitResponse: IDKitResult;
   };
 
+  /*
+   * Set the expected environment on your backend. Reject proofs from other
+   * environments before verification, including staging and sandbox in production.
+   */
+  const expectedEnvironment = "production";
+
+  if (idkitResponse?.environment !== expectedEnvironment) {
+    return NextResponse.json({ error: "Verification failed" }, { status: 400 });
+  }
+
   const response = await fetch(
     `https://developer.world.org/api/v4/verify/${rp_id}`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify(idkitResponse),
+      body: JSON.stringify({
+        ...idkitResponse,
+        environment: expectedEnvironment,
+      }),
     },
   );
 
@@ -336,6 +349,15 @@ export async function POST(request: Request): Promise<Response> {
     return NextResponse.json({ error: "Verification failed" }, { status: 400 });
   }
 
+  const verification = await response.json();
+
+  if (
+    verification?.success !== true ||
+    verification?.environment !== expectedEnvironment
+  ) {
+    return NextResponse.json({ error: "Verification failed" }, { status: 400 });
+  }
+
   // Uniqueness: store the nullifier (Step 6).
   // Sessions: validate and store the session result (see the session guide).
   return NextResponse.json({ success: true });