Worldcoin 🛠 Global Proof of Personhood with World ID

foreign [Music] hi everyone I'm Ian dillock I lead developer relations at worldcoin and I'm here to tell you about world ID our Global proof of personhood protocol I will try to keep this to within 20 minutes so we can get back on track in here so what I'll go over in this Workshop what world ID is why worldcoin created it what you can do with World ID and most importantly how to integrate it quite simple actually so worldcoin sort of big question that we're answering with World ID is how do you know who or what is a real and unique person right you want to know that your user isn't a bot and you want to know that they're only going to do something once World ID helps with both of those so World ID just a couple months ago became publicly available before that it was on a wait list but thankfully that's gone and World ID is designed to be private inclusive and robust right we want to collect as little information as possible about who you are we want as many people as possible to be able to participate in this system and we want to make sure that each person can only have one world ID so we looked at a bunch of different ways that we could actually like get that information about you being a unique human right we looked at verifying with an email or phone but those really aren't robust I have multiple emails I have multiple phone numbers breaks that tenant we looked at doing kyc of official government IDs but less than the global less than half of the global population has a digitally verifiable ID so that's not inclusive enough for us we looked at web of Trust Systems but they really don't scale to all of humanity super well if you start with an initial verified set of you know 100 or even a thousand people you have to be many hops away from that initial set in order to verify say a billion people and every hop away from that initial trusted set you are is really the less trusted you are so we settled on Biometrics which initially sounds a little bit scary but it is something that you can actually do in a privacy preserving way and when it comes to which Biometrics we use we looked at fingerprints face scans Palm scans but none of those actually have enough entropy to distinguish you know between billions of people face ID and Touch ID on your iPhone can distinguish about 130 million people that works fine for making sure that you are the same one person who set up face ID on that phone right if you're one of the like 12 people in the US who could steal my phone and unlock it with face ID you know what more power to you we also looked at DNA in incredibly high level of entropy also incredibly invasive it's impossible to like not know a lot about that person if you have their DNA so we settled on Iris Biometrics because it doesn't tell much about who you are but there is an incredibly high level of entropy so it can actually be used to distinguish between people at the scale of all of humanity right even identical twins have very different irises and when it comes to how we do those Iris scanners we looked at using users phones but the issue is that the resolution on the cameras there isn't high enough to capture that level of entropy that we need to distinguish billions of people we looked at off-the-shelf Hardware like what they use for clear at airports in the US but it's really expensive also is used for one to one right are you the same person as your ID versus you know are you unique from billions of other people so we settled on building custom Hardware and that Hardware is the orb you might have seen them in our booth you might have heard about them before so the orb's been in development since early 2020 gone through lots of different revisions um and is also the Hardware's 95 open source we have an open source to the hardware for like tamper resistance and security for hopefully clear reasons but all the rest of the hardware you can go look at on our GitHub right now if you're someone into Hardware like that so the orb first make sure that you're actually a human not a photo of a human not a cat or a dog takes photos of your irises calculates this Iris code so a non-reversible digital representation of the pattern of your iris if you don't opt into Data custody we never store those images that the orb takes they get deleted from memory on the orb they don't even touch its storage and then we use that Iris code check to make sure it's Unique from all the other Iris codes of everyone else who signed up at the orb before and with that we verify your world ID the public key of your self-custodial identity in World app gets added to a Merkle Tree on chain and I'll talk a little bit more about how that actually makes World ID this proof of personhood protocol that's everything the orb does World ideas designed to be privacy first decentralized and open source so again we don't ask your name your email your address your ID anything like that we ask your phone number but that's optional uh it is decentralizing right we have the world's coin Foundation that stewards this protocol right now the orb is the one device that you can use for verifying at the highest level with World ID but we are exploring other verification methods and those may even come from other companies and it's open source all of our smart contracts our signup sequencer everything like that on GitHub you can go deploy your own if you'd like World 80 has lots of different use cases right voting is one that makes a lot of sense you want to know that the person voting is actually a human and not a bot and that they only get to vote once on each proposal and as an added bonus you can't correlate two different votes on two different proposals back to the same person so it helps with that privacy aspect right social media again you want to know that it's not a bot customer incentives is one that I find particularly interesting maybe you want to give your user a side of discount but sometimes with sign up discounts users get them more than once I know I've spun up multiple emails to get a bunch of those two-week free trials on Netflix and but if they used World ID maybe they'd be willing to give you a three-month free trial because they know you're getting that free trial only one time and we've also designed World ID to be super super easy to integrate you can use it on the web on mobile and on chain there's two main ways to integrate World ID and the first and the easiest is sign in with worldcoin so let's see what it's like to use sign in with World tone we actually use sign with worldcoin for logging into our developer portal so I'll go ahead and show what that looks like now so when I hit log in takes me to this page with a QR code I can scan this from within World app or I can even just scan it with my phone's camera and it will automatically direct me into the app see okay I want to it wants me to sign in with world.e for the developer portal I tap verify with World ID does a little face ID check oh it didn't work because I had been waiting on the page too long promise this works I just had that page open for like half an hour before this verifier with World ID do the face ID check and now I'm logged into our developer portal so any of you who are building on world ID will need to log into this developer portal you can add a new app give it a name select staging your production if you choose staging you have to use the World twin simulator which I'll show you in a little bit if you choose production users have to use the world at and then you can also choose cloud or on chain and again I'll talk about that in a little bit but developer portal is pretty simple and it's a really simple flow for sign in with World ID and there's lots of different ways you can actually integrate sign in with World 20 into your app we have an integration with auth0 if your app already uses that for sign in nextdoth.js uh we have a template repository for that one that makes it super simple uh you can use our oidc well-known file with any other openid connect Library you can custom Implement open ID connect flows but I'll walk through how you can do it with nextdoth.js this is all it takes to integrate sign up with worldcoin if you use next.js this is the file for configuring nexus.

js we set up a provider for worldcoin we passed it that well-known file that tells it all of the configuration parameters it needs you have to set the client ID and client secret that you get from the developer portal in your environment variables and then we assign the nullifier hash that you'll get back from World ID as the unique ID for that user and the credential type whether they are phone or or verified those are the two credentials available in World ID phone being much much weaker they verified their phone number in World app your app doesn't get to know that phone number because of the zero knowledge proof system we use to preserve the user's privacy or they're verified at the org so to use anonymous actions which are quite a bit more powerful and more configurable there's a little bit more complexity but it's still really simple using Anonymous actions you can know that your user is a unique human doing something once or an arbitrary number of however many times you want to limit them to doing it with a specific signal that signal is optional but that's an extra bit of information that can be encoded into the zero knowledge proof so that you know it's not tampered with for example that signal for claiming an airdrop would be the address that that airdrop is being sent to or if it's a voting situation that signal would be Which choice they're actually voting for in that proposal and the basic flow for anonymous actions is that the user scans that QR code from our front end widget user generates the proof on their device and then your app has to verify that proof either with our API or on chain and I walk through the front end widget and how you can verify both of the API and on chain but it's important to note you have to verify the proof I'll reiterate it again later but that's an essential step here so let's see a quick demo of what using Anonymous actions looks like and this is where I will also introduce you to the simulator so on our docs page we do have a little try it out section this is demonstrator so for anonymous actions I'll choose staging so I can use the simulator here at simulator.worldcoin.org looks pretty similar to World app we'll just leave this at Test action for the action name and will only accept orb credentials so I click continue with worldcoin and the idkit widget pops up and it takes a minute to load this QR code I'll reload the page real quick because again sometimes things are a little bit slow and I'm tethering to my phone for internet right now there we go let's try this again staging Test action sure you knew with world's coin so pops this up if I'm using World app as like an actual end user I would scan this QR code with my phone for the simulator you can either run the simulator on your phone just in the mobile browser and you can also scan it with the camera just like you would in World app or if you want to run the simulator on your laptop or desktop like I am now you can actually just click the QR code an ID kit to copy that information so hit scan QR paste data I'll go to manual input since I'm on the computer I paste in everything that got copied from the QR code and hit submit alright so because I'm in the simulator I can select which credentials I want to allow click verify with World ID and the proof was successful and if I actually look at the console here you can see what gets returned from ID kit and again I'll talk a little bit more about that in one second so with idkit it's one react component you can also use it with vanilla JS um that is described more in our documentation so you have to provide it a couple parameters one is the action so the name of the action that you've configured in our developer portal on success and handle verify are two callback functions handle verify is optional but it runs while idkit is still showing a sort of pending state after the user has generated that proof on their device and sent it back to your app on success runs after the modal has closed app ID again that's from your developer portal credential types you can also just leave that blank it defaults to only orb but you get to pick which credential types you want to actually accept it also needs a child component that is you know typically just going to be a button that will open this widget so this response that we saw in the console on the try it out page of the developer of our documentation this is what gets sent as an input to the two callback functions handle verify and on success so we have the Merkle root which is the root of the Merkle tree that this proof has to be verified against the nullifier hash is the unique identifier of your user in the context of that specific app and action so if if that app ID and action name are the same the same user will always generate the same nullifier hash but if that action name changes or the app changes then user will always have a different nullifier hash that helps preserve their privacy prevents tracking that user across multiple actions but that nullifier hash is also what we use for civil resistance because if that user tries to do the same thing twice we know we've already seen that nullifier hash the proof is the super long hexadecimal string that actually is like the zero knowledge proof that we do all the fancy math to verify and finally you get the credential types that that user is verified with in this situation just orb so we have to verify the proof just receiving that back from the widget doesn't mean anything any information that's just in the front end like that your user can manipulate and if you don't verify that proof either with our API or on chain you don't actually know if the user is a unique human or not your project is not eligible for bounties from worldcoin if you don't verify that proof have to implement this properly verifying the proof is important I cannot reiterate that enough so if you want to verify that proof with our API then quite simple the base URL would be developer.worldcoin.org API V1 verify slash your app ID that is the endpoint for proof verification so you send it a post request with the body basically being what you got back from idkit you know that thing right here plus uh information about your app ID and action name uh and the signal if that was used as well so you should first send that information to your back end and then your back end should call this API endpoint and if you get a 200 response great you know that user is a unique human they're doing this thing within the limited number of times you've set in the developer portal for API verification apps ones where you selected cloud in the developer portal there's a drop down and you can select how many times you want to let them do that action um and yeah otherwise there will be an error we'll have some description of what the error actually is whether that that the proof didn't verify correctly or that the user has already performed this action and again there's more detail in our documentation docs.

worldcoin.org so after you've gotten that 200 response still in your back end that's where you should do something like setting your user is verified in a database right do that thing in the protected environment that you control rather than from the front end if you want to verify a proof on chain it's a little bit more complex but still really simple in the Constructor we set you know the world ID which is the address of the world ID router contract we have an address book in our documentation make sure you use the relevant address for your chain uh in terms of change we support ethereum optimism and polygon both on mainnet and test net girly Gurley and Mumbai and additionally we support bass Gurley for test Nets as well uh so in this example we're just doing a single action so we set this stuff in the Constructor the external nullifier is essentially just the app ID and action ID shoved together um this proof verification system is built on SEMA 4 so external nullifier is the terminology they use and then in this function verify and execute and we would verify this proof and then immediately after do something like minting an nft to that user for example so in in this situation we use the signal as the address to or hypothetically we could use the signal as the address to Mint those tokens to uh the first thing we do in this function is check if we've seen this nullifier hash before uh one thing I left out in the earlier slide was defining the mapping of nullifier hashes or if you set it to true you've seen that nullifier hash before first thing we do is check if we've seen it before if we have revert then we try to verify the proof we include that signal the group ID for verify proof is going to be one for orb verifications we don't support the phone credential on chain so you can hard code that to one in your contract with no issues and then the rest of the information is what we received from idkit if that proof doesn't verify for whatever reason right that will revert and the transaction won't continue so if that doesn't revert immediately after that we should go ahead and set that nullifier hash to true so that we track that we've seen that nullifier hash before right the one big difference between API verification and on-chain verification is that for on-chain verification you have to implement the Civil resistance part of it yourself that is why we're tracking the nullifier hashes here it's very important you do that if you want civil resistance we can do that for you with the API verification we can't do that for you for on-chain verification finally after we've set that nullifier hash is true to know that we're tracking it go ahead and do whatever else you want so we have 20K worth of bounties 5K the best overall 2500 each to best governance app most creative best AI use case best sign in with worldcoin app two thousand dollar two one thousand dollar honorable mentions and a three thousand dollar prize pool for every project that properly integrates World ID whether that's sign in or Anonymous actions and doesn't receive another prize yeah and let's build together if you go to worldcoin thank you if you go to worldcoin.org nyc23 you'll find a notion page with a lot of the information contained here information on our bounties a ton of resources links to our documentation developer portal template repositories everything like that and if you have any other questions or want to get verified at the orb come find our booth it's like all the way in the back corner thank you all