> ## Documentation Index
> Fetch the complete documentation index at: https://docs.world.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Register an application, connect to the World ID issuer, and add step-up authentication.

> [!NOTE]
>
> Unless a section explicitly says Sandbox, examples use the production issuer
> `https://auth.world.org`. For sandbox testing, use `https://sandbox.auth.world.org`
> for discovery, portal registration, credentials, and all authentication endpoints.
> Keep every part of an integration in the same environment. See
> [Test your integration](https://docs.world.org/agent-pass/testing.md#test-in-the-sandbox).

World IdP returns a signed authentication result and a sector-scoped account
identifier. Your application owns its accounts, sessions, permissions, and actions.

## Choose your integration

[Set up your client](https://docs.world.org/agent-pass/app-registration.md), then follow the path
for your application. An existing auth server can act as the OIDC client.

| Goal | Guide |
| - | - |
| Authenticate through a browser | [Authorization Code Flow](https://docs.world.org/agent-pass/connect-your-backend.md#sign-in-through-the-browser) |
| Authenticate a CLI or client without a browser callback | [Device Authorization Grant](https://docs.world.org/agent-pass/connect-your-backend.md#sign-in-a-headless-agent-device-flow) |
| Require recent or specific authentication before an action | [Step-up authentication](https://docs.world.org/agent-pass/step-up.md) |
| Pause an agent workflow for a human checkpoint | [Human checkpoints](https://docs.world.org/agent-pass/step-up.md#human-checkpoints) |
| Use World ID for your application's primary sign-in | [Primary sign-in](https://docs.world.org/agent-pass/connect-your-backend.md#primary-sign-in) |
| Authorize access to your MCP server | [MCP authorization](https://docs.world.org/agent-pass/connect-your-auth-server.md) |
| Accept delegated access through an XAA-capable host | [Cross-App Access (XAA)](https://docs.world.org/agent-pass/xaa.md) |

Keep your existing sign-in and add step-up when your application needs World ID
authentication before sensitive actions. The [Tokens and identity reference](https://docs.world.org/agent-pass/id-tokens-and-identity.md)
defines subjects and authentication claims.
Choose which [credentials and authentication classes](https://docs.world.org/agent-pass/id-tokens-and-identity.md#credentials-and-authentication-classes)
your application accepts. To allow either Orb or Selfie Check, list both classes
in your [authentication request](https://docs.world.org/agent-pass/step-up.md#accept-orb-or-selfie-check).
Before launch, complete the checks in
[Sandbox and testing](https://docs.world.org/agent-pass/testing.md).

## Environment values

| Setting | Value |
| - | - |
| Issuer | `https://auth.world.org` |
| Discovery | `https://auth.world.org/.well-known/openid-configuration` |
| Developer portal | [Portal](https://auth.world.org/portal) |

Use registration, credentials, and discovery from the same environment. The
[authentication profile](https://docs.world.org/agent-pass/connect-your-backend.md#configure-your-oidc-library)
lists supported scopes, grants, signing algorithms, and client requirements.

## Other World ID integrations

These guides cover OIDC integration with World IdP. Use World IdP's
registrations, credentials, and identifiers only for that flow; IDKit proof
applications use their own.

* **IDKit uniqueness:** use a nullifier scoped to the application and action for
  one-use eligibility. Verify the proof on your backend and atomically reject a
  previously consumed nullifier. Check authentication freshness separately from
  stored uniqueness results. Follow the
  [IDKit setup and verification guide](https://docs.world.org/world-id/idkit/integrate.md).
* **IDKit sessions:** use repeated proofs of the saved `session_id` for account
  continuity. Each check still requires user interaction and a fresh proof.
  Use `session_nullifier` to identify a proof for replay checks. Manage
  application login cookies and World IdP browser
  sessions separately from proof sessions. Follow
  the [session-proof guide](https://docs.world.org/world-id/idkit/session-proofs.md)
  for registration, signed requests, verification, and replay checks.

**Legacy Sign In with World ID is deprecated.** Use World IdP's OIDC flow for
new sign-in integrations; legacy credentials and identities are not interchangeable
with World IdP's.

Apply the selected product's credential, environment, request-expiry, and replay
rules. Validate the resulting assurance and check business permissions in your application.
OIDC authentication remains repeatable. For one-use benefits, enforce your own rule with
atomic consumption in the
[appropriate identity scope](https://docs.world.org/agent-pass/id-tokens-and-identity.md#store-and-match-sub).

## Get help from a coding agent

Give your coding agent the public guides. For optional registration and management
tools, follow [Coding-agent setup](https://docs.world.org/agent-pass/build-with-a-coding-agent.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.