Skip to main content
Unless a section explicitly says Sandbox, examples use the production issuer https://auth.world.org. For sandbox testing, use https://sandbox.auth.world.org for discovery, portal registration, credentials, and all authentication endpoints. Keep every part of an integration in the same environment. See Test your integration.
World IdP returns a signed authentication result and a sector-scoped account identifier. Your application owns its accounts, sessions, permissions, and actions.

Choose your integration

Set up your client, then follow the path for your application. An existing auth server can act as the OIDC client. Keep your existing sign-in and add step-up when your application needs World ID authentication before sensitive actions. The Tokens and identity reference defines subjects and authentication claims. Choose which credentials and authentication classes your application accepts. To allow either Orb or Selfie Check, list both classes in your authentication request. Before launch, complete the checks in Sandbox and testing.

Environment values

Use registration, credentials, and discovery from the same environment. The authentication profile lists supported scopes, grants, signing algorithms, and client requirements.

Other World ID integrations

These guides cover OIDC integration with World IdP. Use World IdP’s registrations, credentials, and identifiers only for that flow; IDKit proof applications use their own.
  • IDKit uniqueness: use a nullifier scoped to the application and action for one-use eligibility. Verify the proof on your backend and atomically reject a previously consumed nullifier. Check authentication freshness separately from stored uniqueness results. Follow the IDKit setup and verification guide.
  • IDKit sessions: use repeated proofs of the saved session_id for account continuity. Each check still requires user interaction and a fresh proof. Use session_nullifier to identify a proof for replay checks. Manage application login cookies and World IdP browser sessions separately from proof sessions. Follow the session-proof guide for registration, signed requests, verification, and replay checks.
Legacy Sign In with World ID is deprecated. Use World IdP’s OIDC flow for new sign-in integrations; legacy credentials and identities are not interchangeable with World IdP’s. Apply the selected product’s credential, environment, request-expiry, and replay rules. Validate the resulting assurance and check business permissions in your application. OIDC authentication remains repeatable. For one-use benefits, enforce your own rule with atomic consumption in the appropriate identity scope.

Get help from a coding agent

Give your coding agent the public guides. For optional registration and management tools, follow Coding-agent setup.