Start here
World IdP returns a signed authentication result and a sector-scoped account identifier. Your application owns its accounts, sessions, permissions, and actions.
Choose your integration
Set up your client, then follow the path for your application. An existing auth server can act as the OIDC client.
| Goal | Guide |
|---|---|
| Authenticate through a browser | Authorization Code Flow |
| Authenticate a CLI or client without a browser callback | Device Authorization Grant |
| Require recent or specific authentication before an action | Step-up authentication |
| Pause an agent workflow for a human checkpoint | Human checkpoints |
| Use World ID for your application's primary sign-in | Primary sign-in |
| Authorize access to your MCP server | MCP authorization |
| Accept delegated access through an XAA-capable host | Cross-App Access (XAA) |
Keep your existing sign-in and add step-up when your application needs World ID authentication before sensitive actions. The Tokens and identity reference defines subjects and authentication claims. Choose which credentials and authentication classes your application accepts. To allow either Orb or Selfie Check, list both classes in your authentication request. Before launch, complete the checks in Sandbox and testing.
Environment values
| Setting | Value |
|---|---|
| Issuer | https://auth.world.org |
| Discovery | https://auth.world.org/.well-known/openid-configuration |
| Developer portal | Portal (opens in a new tab) |
Use registration, credentials, and discovery from the same environment. The authentication profile lists supported scopes, grants, signing algorithms, and client requirements.
Other World ID integrations
These guides cover OIDC integration with World IdP. Use World IdP's registrations, credentials, and identifiers only for that flow; IDKit proof applications use their own.
- IDKit uniqueness: use a nullifier scoped to the application and action for one-use eligibility. Verify the proof on your backend and atomically reject a previously consumed nullifier. Check authentication freshness separately from stored uniqueness results. Follow the IDKit setup and verification guide (opens in a new tab).
- IDKit sessions: use repeated proofs of the saved
session_idfor account continuity. Each check still requires user interaction and a fresh proof. Usesession_nullifierto identify a proof for replay checks. Manage application login cookies and World IdP browser sessions separately from proof sessions. Follow the session-proof guide (opens in a new tab) for registration, signed requests, verification, and replay checks.
Legacy Sign In with World ID is deprecated. Use World IdP's OIDC flow for new sign-in integrations; legacy credentials and identities are not interchangeable with World IdP's.
Apply the selected product's credential, environment, request-expiry, and replay rules. Validate the resulting assurance and check business permissions in your application. OIDC authentication remains repeatable. For one-use benefits, enforce your own rule with atomic consumption in the appropriate identity scope.
Get help from a coding agent
Give your coding agent the public guides. For optional registration and management tools, follow Coding-agent setup.