Polygon 🛠 Polygon Building Issuers with the Polygon ID API - Rahat Chowdhury

foreign [Applause] [Music] welcome to my workshop building with polygon ID API um what we're going to be doing today is still focusing a lot on like the full kind of like full stack flow of how you would build with polygon ID but introducing the concept also building with the API so um hi I'm Rahat I'm the lead developer relations engineer over at polygon previously I've been a front-end engineer as well as a solidity engineer Indie hacker web Enthusiast I've done a few of my own startups which have all failed so I can't tell you how to succeed on that side of things but I can tell you what not to do and maybe that'll take you part of the way there um these are just some places you can find me I'm most active on Twitter uh LinkedIn I guess um and GitHub is where you can find some of the code examples that we'll be going through and I'll also link I'll link to that later on as well but first let's play a game um this image that you see on the uh for here is a claim the claim is that I am a pixelated Punk so can you all verify am I a pixelated punk are these two images the same yes or no yes no so the correct answer is yes so corporate needs you to find the difference between these two pictures there's no difference it's the same that's what we're going to say for now but essentially what we just did was you just participated in what sort of like an IRL version of polygon ID there is first what's called an issuer who is issuing some type of claim some type of um information about you you're holding that information in some capacity and then some type of verifier is verifying if that claim is true or not and we'll break that down a little bit further but what exactly is polygon ID so polygon ID is a blockchain native identity system with programmable privacy what does that mean it's a little bit of what I just kind of explained was called a triangle of trust you can program different parts of the triangle of trust to share specific things about yourself on a need to know basis right we're going to be utilizing and taking advantage of ZK proofs to only share information that in any end sort of Corporation or verifier needs to know so this is just a little diagram of that triangle of trust so this initial claim or this nft was created by pixel portraits shout out to pixel portraits by the way they're awesome and that that nft is owned by me um you can go to my uh wallet and see it or whatever and um what you all did was like verify that you know that is indeed me it's it's like the pfp that I use on Twitter it's BFE I use on a bunch of different places and I don't know how to personify a ZK proof in real life one day I will figure that out and it's going to be amazing but well but essentially what you'll usually do in these cases is like you only share a specific part of that claim or that ID so let's say a local Municipal issued you a driver's license they should use some type of identification right what are some of the key pieces of information on that um driver's license you have your name date of birth address a bunch of different information right anywhere that needs your ID you end up giving them your ID and they have access to all of this information but they may only actually need one or two pieces of information from there right or they may not even need to know 100 what your date of birth is in the case of like if you're going into a bar or a place that requires you to be 21 or older what if you could verify you're 21 or older without giving them your actual date of birth and that's the kind of like the concept we're going to be focusing on today a little bit so in previous workshops um I've we've gone through the flow and we wore two hats we were both an issuer and a verifier in this Workshop we're still going to be both but uh we're going to look at two different Pathways and two different types of applications you can build during the workshop so you can during this hackathon be your own issuer build that out yourself and we'll go into like what that means in a second or you can be a verifier create an application that consumes some type of claim that has been issued by whatever issuer you trust in real life these two entities should be different hopefully because you don't want to issue claims and then only trust the claims that you've issued that's not really decentralized I guess so you would have probably um an issuer who is tied to some you know verifier like a local municipal or something like that who issues you that ID or issues you a claim and you would have these claims that can be verified it's up to the verifier to trust the issuer and that's where that triangle trust comes in it the verifier has to trust that the issuer gives proper credentials for all of this to work so let's look at some demos and some code so what you'll see here right now is uh what sort of the UI platform for testing out and giving people claims so if I wanted to make a new claim so I would go here and create schema this is all on platform Dash test.polygonid.com this link will be available in the repo which I'll be tweeting out so there's a bunch of different information that you can put in here but let's say I want to put in something like um how old am I um age verification date of birth so in this I would I would name my schema something so I named the age verification and I would give my attribute um something which would be date of birth and I have three data types that I can choose from I can choose a Boolean yes or no I can choose a date or I can use a number so I'm going to choose date just because we chose date of birth uh this is optional over here um what you can do actually is click this and add an expiration date for your claim so that a claim after a certain amount of time will no longer be valid I don't think it really makes sense in this case but you might find different use cases for where you might want to do something like that so you click save and offer claim great um now in the attribute I can put in my date of birth I'm not going to put in my real one but let's see we'll do September 25th and this is again optional so I'm just going to leave that alone I hit generate claim offer and I'm going to go ahead and open this link so this link is now a claim but I can verify that I can add to my polygon ID wallet so the polygon ID wallet is a mobile application you can download it from the app store or Google Play and that is where your your claims or your credentials are going to be held so this as soon as I scan this with my polygon ID app it's going to add this claim to my wallet when it's added to my wallet the thing is it's not saved on a blockchain it's not saved anywhere it only exists on your local app nowhere else so everything is really dependent on your local storage it's not saved anywhere you'll see that under my attributes I have my date of birth listed over here although this is listed here when someone makes a query to understand this information what they can do is query for was this person born after this certain date so instead of giving them the information that I may have been born on September 25th 1991 their query would simply verify that whatever their starting age point is is greater than or less than mine so they don't need to know my actual date of birth they just need to know that I meet a requirement so we'll take a look at those queries in a second but this is the UI platform for issuing a claim now the issue here is you this this is not something you can use to make sort of like a robust solution for issuing claims right if you wanted to become an issuer yourself you wanted to maybe partner with a local Municipal if you wanted to verify different things whether it be date of birth whether it be income level whether it be um I don't know Dao membership nft whatever and like pretty much whatever you want you can create an app that does that verification and creates these claims so how would we do that what we've got here is an overview of the polygon ID documentation and one of the things that we've recently launched is the polygon ID platform API so now rather than going through and building on top of that UI platform you have different endpoints that you can use to issue claims yourself through any type of front end that you want so on your front end maybe you want to verify someone's ID maybe you want to verify that they own a certain nft maybe you want to verify income level in some way for like credit scores or things like that you can do anything that is traditionally done in web 2 gather that information and then issue a claim based on that right so now you have the possibility of bringing things into polygon ID such as credit scores income level um you know age verification which is again what we're focusing on today but kind of like whatever you can think of um it's up to your front end whatever your front end does is what it does and you issue a claim based on that so if you wanted to go in and um look at that API we have an API um reference here all of these different endpoints can be run right away in post span so you can go in try them out uh play around with them I definitely recommend if you want to build your own issuer try out all these different endpoints and see what's possible and one of my teammates Steph has actually created an awesome little starter template so this is a react front end which allows you to it hooks up immediately with the polygon ID API all you have to do is go in and change a few environment variables and you're kind of like already set to go you can build um you know different things on top of that but this is a really great starting point especially if you decide that during the sackathon you want to focus on the issuer side you want to build your own issuer you want to build some type of um you know verification platform so check this out you can Fork this repo it's already it's already got a few of the different endpoints that are available on that API kind of like put it in there you can add more as you go depending on your use case so that is the polygon ID platform as well as the API those are the two different ways right now that you can issue claims so what do you do after you've issued a claim one thing that we see a lot especially now in things like social media Instagram Twitter and everything like that it requires you to be 13 years or older at Point at some times to use it right so again we come to this point do do we have to share our date of birth every single time to these different platforms do they really need to know our date of birth no they just need to know if we're 13 or older so that we can actually use the platform so in my case I created a couple of uh claims already through here that verified that my age is over 13. when you do your actual verification if you want to you can build out a solution that you know verifies ID and everything like that totally up to you polygon ID itself is really just like the platform that you would use to like issue the claims hold those credentials and verify them you're at the actual like process of verification kind of happens elsewhere and you can bring that into polygon ID so I created this like small dap where um it checks whether I am 13 years of age or older or not and as long as I am 13 years of age or older I will mint a soul bound nft but I can use the token gate different um social media platforms for example let's say You're Building on top of lens protocol maybe you want to tokengate a lens protocol specific application if we wanted to build a social media that's I guess more compliant with like what web2 standards are right now and we wanted to make sure that you know folks only folks 13 or older were using something like a lens Instagram or a lens Twitter type thing we could use this token this to tokengated after verifying someone's 13 or older so I've got a couple contracts in here the main contract that I'll focus on today is going to be this ERC 721 verifier and it's inheriting from a couple of different um libraries so these Library um contracts are ones that you can just copy and paste right into your code cool thing is if you wanted to just get started and you're not too familiar with the ZK side of things we give you a couple Library contracts so you can get started Leverage The Power of ZK proofs and kind of like abstract it away at least for this hackathon though I do definitely recommend you go in dive into it and learn more about it as you go through so in my case I have all of these um saved locally you would want to make sure that you also have those saved locally you can grab those from the tutorial in the polygon ID docs as well as any one of the repos that I'm going to be sharing with you today and this is just a basic ERC 721 token nothing fancy going on here it's called social age check or sac and the three main things that you want to focus on that do the magic here is this first function before proof submit and after proof submit before proof submit is going to check that the challenge input of the proof is equal to message.c Sender so you want to make sure that the person who's actually verifying using their polygon ID wallet is the person who is also trying to Mint this nft there got to be one person right and then after proof submit is where you can basically once like these verifications are completed this is where you can do pretty much whatever you want inside of this if statement um it's pretty much nothing related to polygon ID it's just me minting an nft so in here I've got the safe Min function which is taking the message.

cender as well as a new Item ID that I created up here and setting the token URI for an on-chain nft so that on-chain nft is just being generated over here it's just an SVG nothing fancy an SVG that just says that I am indeed 13 years of age or older and you'll see for my before token transfer this is where I'm making sure that this becomes a soul bound token that you can no longer transfer it your age is your own not someone else's you can't verify your age for someone else and there's a few other tutorials that do some similar things here you can do something like if you were doing like an erc20 airdrop you want to make sure that that person or whoever you transfer the rc20 tokens to have actually been verified by polygon ID so this is the location where you would like do everything like that cool so let's go back to here and I've got a quick demo of that in action so this is the polygon ID uh wallet um pretty simple you open up your app you um actually hold on I actually skipped something sorry about that so one thing I forgot to show you so we've got so I've shown you how to like actually build out the um smart contract itself there are two scripts that need to be run in order for you to actually utilize this so these two Scripts can be found inside of scripts firstly is just your regular deploy you want to deploy your function uh deploy your smart contract and then this set request which is going to be how you connect your contract to this contract that has been deployed onto the Mumbai test net so important thing to remember polygon ID the way you're using it right now is on testnet um but essentially this is what's going to connect you to a contract that exists on on the Mumbai test net that allows you to take advantage of a lot of the ZK proofs that are underlying and this is also where you would put um your initial queries for whatever you need to validate so in this case I have an age query I want to make sure that the person who actually uses this specific platform was born before this date definitely take a look at the GitHub documentation linked over here this is a Json query language for building out your query it's nothing too complex you just need to like figure out what each of the um what each of these indexes mean but the operator over here basically lets you know if like the operation should be like a greater than equal to less than so I believe this is number two off the top of my head I think it's greater than but take a look at the documentation and verify that before you do your own query um so that's this is what would set the actual verification for your smart contract and then you have to build out a front end for a user to actually um validate their claim so I built a I forty small front end here that you can check out nothing too fancy just a page where once again you're going to be scanning a QR code from your polygon ID Wallet app but you'll see here that once again you have this QR proof which is a Json query language again just take a look at the documentation there to understand like what pieces of data that you need but this is going to be more related to the schema that you generate from your claim so you're going to put some information regarding that and you'll see here that for birthday I'm checking if it's less than the specific date so those are like the key pieces of information that you need as well as like the schema details which you can get one from your claim after you've uh claimed it but from here so it's pretty simple from here you just use your polygon ID wallet to verify uh that ownership so let's go back a little bit so again open up my uh wallet I scan the QR code a proof request is then sent I want to generate the proof now it'll actually go to my regular wallet so I'm going to connect to metamask and sign the transaction so I go ahead I connect my account the proof is now being generated and remember we're minting an nft at this point so there's going to be another transaction that we have to sign um with through metamask to make sure we pay our gas so now the actual nft is being created this is the transaction for that cool and once you're all set you hit confirm now you own a soul bound nft that has done some verification that you are 13 years of age or older and you own this um as an nft so again I'm not an artist so you get a very basic uh nft here uh that says that I am verified 13 or older this is a slowbound nft that you can use to now gate different social media platforms this is just like one very very basic use case um so there's a lot of different things that you can build on here like I said if you want to focus on the issue inside you have the API you have a starter kit from one of my co-workers stuff if you do end up using it make sure you start that GitHub repo tweet at her that you're using it she'll appreciate that and yeah we're really really love to see what all of you build during this hackathon uh just a couple more things these are some additional resources that you can use to build um I actually just tweeted out uh the link to this GitHub repo which contains everything including the slides so if you go on my Twitter that is at or hotcodes you can link link over to the GitHub which contains the slides all of the resources all of the links that you need and I would highly recommend also going back um and checking out Steph's original polygon idea Workshop from eth Bogota she did a great really good introduction on like the very like core basics of like how everything kind of works um Stefan Manny's GitHub repos have additional examples of how you can build on top of it as well Manny's GitHub repo contains common errors that you might run into as you're building so you know if you ever get stuck need some help I'm troubleshooting um then it has listed out and um taking screenshots of like very common errors you might get and how to fix them cool and if you've enjoyed this Workshop please let us know on Twitter uh we're at Xerox polygon devs as well as adderall hot codes which is me and I would love to take any questions let's still have to wear this anyone have questions thank someone over here so once the issuer issues the claim what if somebody else scans the QR code than the one who you have issued it to so once you once one person like scans um that specific uh QR code another person would not be able to scan it it's like specifically for that one-time use case what if before the actual users can sit somebody else scans I mean what what you would the ideal kind of like situation would be that you do your verification and you send a unique link to that specific person as long as they're not like you know that's just like common web 2 security issues as long as they're not doing anything um like you know Common phishing attacks or things like that you should be fine um so that would be up to the kind of like the user to like protect their link okay uh just one more question uh there is this age related thing that we did lesser than uh 2009 January 1st right so in a few years it will be uh the date will change right so how will the you have to update the uh front end accordingly and yeah so you can update your query um at any time um both on the smart contract as well as the front end so on the smart contract the second script that we've run um that can be run as many times as you want you can update that with different queries with different parameters and your new query would be what would be verified okay yeah hello here so uh actually like I wanted to know the way um we basically send the zero knowledge proof uh to the smart contract is it possible in a way that uh someone else um like I I create a zero knowledge proof from the polygon ID uh app and then someone else creates a new transaction on the polygon blockchain rather than me doing it and then like basically we can prove that this person actually approved this transaction so someone let's say I assigned a zero knowledge proof and I gave a string or something like that of the proof to you or Json file maybe and then when you send it to the blockchain uh it could be verified that I um you you did it on my behalf and it's allowed to do it so I guess I'm trying to rationalize why you would need ZK proofs for something like that because regular signatures pretty much take care of that for you with like the ects the reason I want it to be is that uh let's say uh because I want to the verification of that that it is authorized by me uh onto the blockchain so uh in the ZK um we are doing this verification on chain so I don't want it to be onto a device where like or maybe in intermediary or any pair device so yeah on the smart contract itself uh you know verifies in ZK so again um I'm I'm it's possible like everything is kind of like built on top of like circum and um like the idea in three protocol like that's underlying um first this specific like way you use polygon ID we're kind of abstracting a lot of that away but if you wanted to go in and create your proofs you could definitely do that um so I guess I'm not sure what the polygon ID specific question is here yeah the specific question is just is that let's say I have a specific use case in which my transaction is being signed and sent to the blockchain the smart contract from a centralized server let's say but I want uh the centralized server like when it sends to the polygon blockchain I want the smart contract to know that it was sent on my behalf at the Smart contract level I want to verify this thing so I'm not sure if signing a message just can I can verify that on the smart contract level but I'm sure like if I send the zero knowledge proof then it could be verified on the blockchain so like kind of like what you're describing right now is what happens pretty much all the time on something like openc um that is literally the process that they use and that's done without GK proofs at all that's just done with signatures you set an approval for like how that you want openc to be able to like transact on your behalf and to sell an nft once like you know you have a specific offer or whatever right um so that's all done without zero knowledge proof so I'm still kind of okay got it yeah so the last question is that let's say uh what's the use case of like I saw the couple of variables uh like types for example like date Boolean and yeah a number so what's the use case of a Boolean like where can we use it and like why is it there yeah I mean if you wanted to do some like true or false if you wanted to keep like the query itself like very simple uh maybe your front end like the issuer has some complex sort of like issuer will be proving that something is true so okay you can clearly tell this like he's telling the value exactly yeah so why do we need proof uh and hide that I'm sorry so the issuer can basically tell so with the zero knowledge proof you will be basically telling that either it's true or not so it's directly Boolean anyway right so um I mean yeah in this in that case yeah I would say I would see here Point um but the way I see it is like it's it's for like just like ease of use in my opinion okay yeah thank you cool thank you any other questions good okay all right thank you all very much um we're oh so where exactly the improving part is is it uh for After Decline like you the issuer issues are claim okay and then it stays in the wallet right so uh the wallet will be sending only the proofs huh so the pro the proving part actually happens like in our case um happened within like the nft smart contract right we had those different libraries that we imported in that takes care of like kind of abstracts away everything so we don't have to like worry about it and there's a smart contract deployed on the move my test Network that you know essentially does a lot of that work for you and um whenever you take your polygon ID wallet you scan that QR code with that Json query inside of it that's what kicks off the smart contract to start the actual proof so all of the information from that Json query is sent to the contract it also gets access to the claim that is in your wallet since that's where you're scanning it from and that's where the actual proof is verified are you all getting feedback too yeah yeah so where exactly is the proof generation happening is it on the device the mobile device or uh that is on the smart contract oh in the smart contractor so if I have a use case in which you know like I'm kind of uh sending the proof right I don't want to expose my public key right is that doable like generating the proof on the device itself um no because like though the device itself all it does is hold your credential nothing more than that um that is the the only um use case for the actual wallet just for holding the credentials um and within the smart contract we're also verifying that this person who's connecting their regular wallet um with you know the polygon ID app is the same person so that will require yeah