World's latest products (IDP vs IDKit) | Mateo Sauton and Aurelien Brezun at ETHGlobal Tokyo 2026

Hello everyone, my name is Orel, this is Mateo, and today we will introduce our newest product: an SDK that allows you to integrate World ID into your application, and an OIDC identity provider for integrating World ID into your authentication stack. So, first M. Hello everyone. Um, yeah, now, one second. We both work at Tools for Humanity.

This is a company that creates products for World, or as you may know it, Worldcoin. I'll start by talking about the problems we solve. You probably all know what's happening on the internet: it's simply full of bots. And that's not very good. Almost half of internet traffic is generated by bots and this creates a lot of problems for us and this is one of my favorite quotes.

This happened earlier this year. Peter Steinberger, the creator of OpenClaw, said in one of the most famous podcasts in the world with Lex Friedman that he saw his agent happily press the "I'm not a robot" button. For me, this moment was a real epiphany; I realized that everything we had done before was great, but I felt that new times were coming for World ID as a product . So for me, that was the moment when we realized, " when we realized, " We need proof of humanity," right? And that's exactly what we want you to leave this room with: an understanding of what this is and why we need proof of humanity.

But first, what is proof of humanity? So proof of humanity? So , proof of humanity: it's essentially a confidential confirmation that you're human, on the internet, of course. Of course? And it's not just proof that you're human; it is also proof that you are a unique person, and this opens up a multitude of opportunities.

Yes. So, proof of humanity is a way for you, as an individual interacting online, to prove that you are unique and that you are human. We want you to create products and projects based on this primitive at this hackathon. Of course. We are solving several problems that I think you might find interesting as inspiration.

For example, we are addressing the problem of impersonation with a solution we are working on to combat deepfakes and syphilitic attacks. We prove that you are human and that you are unique. So, you are not a bot. Okay, that's another piece of evidence you can show. We can control mass abuse and fake accounts because you are unique, you have your own unique human identifier human identifier , and you can't create a million accounts because they will all be tied to one person.

Um, yes one person. Um, yes , like this. So, this is World. World is a project co-founded by Sam Altman and Alex Blania, where over 39 million users have already downloaded the World App. 19 million of them have been Orb verified, which I'll talk about in a few seconds, in over 160 countries.

Our main and core product is World ID. Again, this is a privacy-preserving identifier that you can display in different places, on websites, in products, etc., and which essentially confirms that you are a unique person, which can unlock many benefits. This is again a protocol that preserves confidentiality. It helps you as a developer build trust in your products and uses a very secure architecture secure architecture , applying zero- disclosure proofs to create these proofs.

Good. So nothing is compromised on either side. Let's have another one. That's it. And we created World ID, initially just as a verification method through Orb, which is the highest level of assurance we have.

So, the user approaches the Orb, which we have at the stand there, you can go up, look and go up, look and , of course, go through verification. Which essentially creates the concept of unique people, right? But we understood that this was not available to everyone and not everywhere. So we needed to create new products, specifically the last two products: official ID cards, which allow users from certain countries with supported documents like passports to scan their NFC ID and passport at some point and, again, using zero- disclosure evidence, prove that they are, for example, a citizen of a certain country. Good.

And we created a product called "Identity at stations" or "Identity check" that allows you to confirm, for example: "I am Argentine," so that I can prove on your website or in your products that I am Argentine, and you can use that, for example, if you don't want to see Argentines, you can exclude them from this product. And the third product we created is "Selfie check." This is the method with the lowest level of guarantee, but also with the least difficulty. Anyone can use their phone's camera to check a selfie from the camera and a selfie your device takes or one you've taken before to make sure it's a person. One more point.

Good. And how can you use all these products? You use them through IDKit, which is our SDK. I'll tell you about the ID Kit. This guy will talk about World ID for agents, which is much cooler than what I do, but I'm still cooler.

Just kidding. So, ID Kit is a tool that allows you to use verification, identity verification, passport or selfie. Not only that, you can also use Face Off, another of our products. Essentially, Face Off compares—if you've been verified through Orb, for example—Face Off compares that image to a selfie taken at that particular moment. So you can check if it's the same person that Orb saw at that moment.

Again, selfie verification is another product I mentioned to you. This is the least secure and least disruptive method you can use to access your platform, or you can create different levels of access based on credentials. Document credentials, as I said, are country-specific, it does n't work for every country. So we'll be adding more and more of these capabilities for other countries over time, but right now it seems to be 35 or 25 countries around the world. And again , you can prove various certifications based on these passports without revealing confidential information.

One more point. Just click this. Boom. And you can get all this through our new World ID app. If you know our project before, we had a huge and beautiful World App.

We divided it into two. The World ID app is the one that allows you to perform all these verifications, and the World Money app, which we released last week, by the way, was accompanied by many press releases and interesting news. This is interesting news. This is , in fact, the way in which you, as a person, can interact with World Chain, mini- World Chain, mini- apps, and the company's financial sector. Now, uh...

Of course, and now I'll talk about World ID for agents—this is our second product, which is much cooler... much cooler... Anna, both products are cool. In general, we have a lot of products. I mentioned five or six different ones, but we didn't want to go beyond the agent world.

We created an agent kit that essentially allows you to delegate your World ID to your agents. Okay, but we thought that wasn't enough. We want to give you more options. So we created this with that in mind . We need a tool to develop an agent economy and ensure human presence in it.

So, essentially, we did this on top of OIDC. Yes, OIDC is a great protocol that you all know, right? You should answer when I ask if you know him. If you say "no", I'll explain what OIDC is, but you know it. Devil.

This is a protocol on top of what you use for your authentication stack. You can integrate an identity provider with your current stack to, for example, perform step-by-step authentication. So, if a person logs into your account or app and you want to offer a free tier or a higher request limit, they can connect World ID to get those higher tiers. And you get a private identifier that is stable for each person. So if a person creates 50 different accounts, you can recognize that the same person is behind them.

This is a major advantage, and it is compatible with any authentication solution like Auth0, Amazon Cognito, or whatever else Auth0, Amazon Cognito, or whatever else you use. Yes, that's cool. I told you. And it also works with MCP servers. Currently, MCP only supports one authentication protocol, and that is OIDC.

You can integrate the identity provider with your current MCP servers that also support step-by-step authentication. So when your application needs additional validation, it can send a request to the user agent, and the agent will prompt the user to connect their World ID. This also addresses the issue of human involvement in the process, and also serves as a basic trust signal so you can be sure that one person won't abuse your program. For example, with the help of hundreds of different agents accessing your service. Yes.

We have thought about this and discussed it with many partners. And one of them was delighted with it. Oh, I know, back. That's it. And I don't know if you know about Monet from Twitter.

This is a huge AI Twitter. This is a huge AI company that creates cool things. So, we've teamed up with them to give you $20 in Monit for the hackathon. Later we will show the QR code so you can use them from your phones. We have many, many QR many, many QR codes.

So, you can just follow the instructions. Essentially, it's just activating a promo code for unique users only. Actually, this is a gift for you from the hackathon. You get $20 to use Monet within the hackathon... within the hackathon...

so it's not you, it's your agent, but you get it. Oh yes, on to QR codes. Everyone loves QR QR codes. Everyone loves QR codes. Let's go.

Okay codes. Let's go. Okay . So, World ID documentation. If you want to integrate ID Kit, follow the first QR code.

If you want to integrate World ID for agents, follow the second QR code. If you want to get $20 in Monet credits, follow the third QR code. Of course, all of this is included in the general list of World prizes. If you don't want to use QR codes, you can follow the links on the website. Yes, I think that's all.

We can quickly demonstrate how this product works. I like it. So, here it is. change full screen, start broadcasting. Yes.

OK. A friend of mine created a website for booking tables at restaurants in San at restaurants in San Francisco. The problem with reservations is that some restaurants are hard to get into because bots book all the seats in advance and then resell them. So my friend created this app: to book a table, you have to be a verified unique person, and this app is also compatible with agents. I'm going to ask Codex to book me a table, book me a table for the test with Matri.

So with Matri. So , Codex is going to interact with this application through the application server, and we should turn on the elevator music now, or something. Or something like that. Well, it works. Any restaurant.

It is called "test It is called "test ". Oh no, no, this is not a test, bro. Oh no. Any restaurant. That's it.

That's how you interact with AI, guys, right? I use TA because it's cheaper. Any time is fine. AGI for the test. Yes, that's all.

Anyway, for all of this, I'm still not authenticated in this app. And when the app gets to the point of booking, it will check whether I have connected my World ID or not. And if not, the MCP should send a confirmation request. That's right. And then Codex picks up that request through MCP.

And now it asks me to connect my World ID. Right. So I just plug in my World ID. You just basically destroyed everyone who wanted to create an app for booking tables at restaurants. You understand that, right?

Just kidding. Okay, done. So, Codex saw that I was verified, and now it's a dependent party. So the application received this identifier. It can recognize me as a unique person, and also see if I have one account or 50 different ones, right?

So, everything is ready, the restaurant is booked, and we can check it out. And the important thing is that this is a one-time verification, right? If I book another table, I won't have to go through this verification again. And now I go into their interface, and you see that my wallet is connected and the table is booked. That's the value of this offer.

World ID for agents. Let's move on to a real-time demonstration. God, I love this. This process would also be possible through a browser. You don't have to use an agent to use World for Agents.

In fact, if you're a human, you can just log in via a browser. And lastly, we have this. So, this works as single sign-on (SSO) through IDP. So, once you are logged in to IDP, you don't need to verify your credentials every time you connect to another application. When you are connected to IDP, you can also manage your applications, see who has accessed your World ID accessed your World ID .

You can revoke access, view your sessions, agents, and more. Yes. And actually, fake IDs are used in the sandbox . So for a hackathon, please don't spend real money, or if you already have a working application and want to provide a free level of access, make it small, because these are fake identities: one person can create many different World IDs. Of course, this problem will not exist in production.

We are very interested in how you integrate this product into your applications. Since it's an IDP, it can work as a primary authentication provider, but we're not trying to compete with Google sign-in or Apple sign-in at all because we don't have a first name, last name, or email address. That is, we don't have all this information. We simply provide a stable private identifier for each person. That's all.

So I think this fits into the multi-factor authentication process, where the user wants to do something that requires additional confirmation, and it is at this point that the application triggers such a process. But again , be creative, we're really curious how you could use this in your app. Yes. That's all. Thank you.

I mean, if you have any questions, we can do that. I want, I want to create a product for ID. Wait. if you have any questions about your products. Let's talk outside, because.

do you have any ways to get it. access to the dashboard for miners. miner miner? Yes, why not? Yes.

Of course. But yes. I need an ID I need an ID account for access. but you can use a sandbox use a sandbox application. Sandbox sandbox will do.

Send. We have a sandbox application. So you can create identities in the sandbox. Without productive, you can be a miner and use this. But this is not real evidence.

This is a sandbox. Yes. Of course. Sandbox. Not really, but we have a simulator for that.

Come by our booth and I'll send you the link. This is also on the World website, but I can show you where you can generate sandbox you can generate sandbox proofs for the passport. Yes. when you do. contact.

Yes. What do you mean by code ? Ahem. We need to ask your friend. I, I never thought about it, actually.

I never thought about it. I don't know, uh. I know the difference. The thing is that. Okay, I was already logged into this app through Gmail.

So, Matray uses Google sign-in uses Google sign-in . So when I logged in, I already had an account with them, but my World ID wasn't connected. So the moment I plugged in my World ID, the app just added a row to the table saying, "This is a private ID," and now they can deduplicate them. So, if I, if I have multiple Gmail accounts, for example, I have several, and if I log in through another Gmail and connect my World ID, they will understand World ID, they will understand that these two people are that these two people are one and the same, right? This should work with the cloud and all agents that we haven't tested yet.

But yes. Yes. So, for the demo application, my friend is using Supabase as the authentication provider, and the IDP can be federated. Supabase has a setting where you can specify the use of an external IDP, just paste the URL just paste the URL and you're done. No, this process works based on OAuth, right?

And "Sign in with Ethereum" is not, we need to check. I'm 99% check. I'm 99% sure it doesn't work based on OAuth. After all, OAuth is a protocol for Web2. So yes.

Do you mean our product, our IDP? You can, actually, but you get...yeah but you get...yeah , I mean, you don't get the person's name, right? If you don't care about the person's name, you can absolutely use that to log in to your app.

You are Aha. You can think about it this way. And of course, the code on your phone will be very different from the code the app receives, for privacy reasons. IDP provides paired subject identifiers. This means that each app gets a different ID, so if you visit, I don't know, Matri and Facebook, and both use World ID, they won't be able to match the traffic.

That is, they will not receive the same user ID. But anyway, you could use this for your authentication needs. Certainly. We can clap.