Worldcoin 🛠️ Global Proof Of Personhood with World ID

[Music] hi everyone I'm Ian I lead developer relations at worldcoin and I'm here to tell you about world ID our proof of personhood protocol so in this Workshop I will go over what world ID is why worldcoin created it what you can do with World ID and most importantly how to integrate World ID so World ID exists to solve one major problem how do you know who or what is a real and unique person we're trying to prove that an account actually belongs to a real human not a bot and that that real human only gets one account right so World ID has been in public availability since the end of July but we are still in beta World ID is built to be private inclusive and robust so on the private app aspect we collect very very little information about you as little as we can we never ask for your name for your email for your government ID the phone number that we ask for in the app is optional so we don't actually know which human you are World ID is buil to be inclusive we want it to be available to as many people as possible and we want it to be robust ensuring that you actually can only get one world ID if you're one real human so there's a lot of different ways that we look to do this sort of proof of personhood and proof of uniqueness we looked at email or phone but neither of those work really well it's super easy to have a ton of different email accounts or a ton of different phone numbers we looked at doing official like government ID kyc but the issue with that is that it's not nearly inclusive enough for us less than half of the global population has a digitally verifiable government ID we looked at doing web of Trust Systems but those don't scale to all of humanity because in a web of trust system every hop away from that initial trusted set of like 100 or a thousand people actually means that you're less trusted so with that we settled on Biometrics and within Biometrics there's a lot of different ways that you can proove uniqueness we looked at using fingerprints face scans Palm scans but all of those actually don't have enough entropy to scale to all of humanity face ID or Touch ID on your phone can distinguish about one in 30 million people which is fine when you're trying to do a one toone comparison right when you want to know that the person in front of the device right now is the same as the person who is in front of the device when they set it up and you know the odds that me being based in the US if the person who steals my phone is one of like 12 people in the whole country who would be able to unlock it with face ID I'm pretty happy about those odds I'll take that but but when you're trying to prove that you're different from every other human if you only have 1 in3 million uniqueness and seven billion people you're going to have a lot of collisions so the complete other end of the Spectrum in terms of the amount of entropy is DNA right everyone's just fully unique but that tells us a lot about who you are and we don't want to know who you are we just want to know you're unique it's also really expensive really invasive so that one was not a good fit for this either and what we said on was Iris Biometrics the iris is incredibly unique there's a ton of entropy there and additionally a good thing about Iris Biometrics is that it inherently involves consent right with like fingerprints or face scans you can get fingerprints off of someone's glass that they drank out of at a restaurant you can get face scans out of someone walking past a sensor on the street but with the iris to get that information you have to have like a very high resolution photo so it's not not something that someone can like capture passively while you're walking down the street and if someone tries to get you to scan your iris and you don't want to you can close your eyes right so it's one that works really well for what we're doing and then how do we get that information from the iris we looked at just using phone cameras but the issue there is that resolution on your phone camera isn't really high enough um and if you try to hold it really up close to your face to get the most out of that resolution that you could they're usually not designed to focus that close and the ones that are that cameras with like macro lenses on phones that's not most phones right so that would break the inclusivity aspect we looked at off the shelf Hardware but again it's a semi-trusted environment um and is usually built more as like a kiosk setup like if you're familiar with clear uh American airports for getting through security um so it's not super portable makes it hard to get it to a ton of people all around the world so we had to settle on custom hardware and that custom Hardware is the orb you might have seen this at events in the past it's at our booth here um we also have a clear one at our booth if you want to take a peek inside but also 95% of the hardware is open source so the orb has been in development since early 2020 um it's gone through plenty of revision since then to make it more secure faster you know generally all the things you try to improve with hardware and what the orb does is that it checks to make sure you're a real human not a cat or a dog not a photo of a human uh also make sure that you're alive it takes photos of your irises and computes an iris code a non-reversible digital representation of the pattern of your iris and it checks to make sure that that Iris code is unique from the iris codes of everyone else who signed up at the orb and once that's done it verifies your world ID by adding the public key of that identity to a Merkel Treon chain that's essentially the list of identities uh so World ID has been designed to be privacy first decentralized and open source as I said earlier we don't really collect any information about who you are right you don't have to give us any personal information in terms of decentralization that's one of our highest priorities right now so the protocol is in the domain of the worldcoin foundation uh all of the code is also open source so everything that's on chain all of our developer tools our developer portal you can view all of that on world coins GitHub there's a lot of different use cases where World ID is valuable right antibot and anti-il or two really really big really broad problems so voting is one great example you want to make sure that someone is actually a real person when they're voting and that they only get to vote once on social media you want to know that an account is isn't to bot for customer incentives this is one that I think is really cool I've spun up probably a dozen different emails to claim like Netflix free trials back when they still did those but if they had used World ID I wouldn't be able to get more than one free trial right so because they know that I would only be able to get one maybe that twoe free trial would be a three-month free trial instead because after two weeks you know maybe you've gotten through like half a season of a show and then you're like oh well I don't have the free trial anymore but if you spend three months with Netflix you're really going to be stuck in there after that three months that's going to be your like go-to weekend thing to do we've also designed World ID to be super super easy to integrate you can use it on the web on mobile and on chain and there's two main ways to integrate World ID one is sign in with worldcoin and the other is anonymous actions so I'll start going through through sign in with worldcoin this is the simpler integration um but it's not as flexible so let's see how signing with worldcoin works so here I have our developer portal pulled up I can go log in so you can either log in with an email address or you can click sign in with worldcoin so when I click sign up with worldcoin it shows me this QR code here so I scan that QR code from within World app you can also scan directly with your phone's camera and it will deep link you into the app op yes this is a live demo the internet here isn't too great it's thinking it's working on it it doesn't normally take this long and we're also uh about to release uh a better bridge to handle these connections between an application and World app that makes it way faster all right let me refresh this page and try that again there we go so I tap verify with World ID and then redirects me back to my app and I'm logged in so I'll also show you a little bit of the developer portal right now I have app an app in here because I've built quite a few things but you can click the app list here and add new app so when you create an app you can choose if you want it to be in staging or production staging we'll use our simulator rather than World app um it has a bunch of prever verified identities that you can use for testing if you're doing things on chain and I I'll explain a little bit more about this later if you're doing things on chain staging is for test net production is for main Nets and then you can choose onchain or Cloud for sign in with worldcoin you have to choose cloud won't work for onchain apps so you can give your app a name and optionally a description um and I can explain a little bit more about the developer portal in a bit but that's what signing with worldcoin looks like it's super easy for the user and there's a handful of ways that you can integrate sign in with worldcoin so you can use our integration with azero uh a major authentication engine um for example ozero is used when you sign into to open ai's chat GPT you can use nextjs which is an open source authentication library for nextjs uh you can use a some other authentication Engine with our open ID connect well-known file that makes configuration super easy you can custom Implement open ID connect flows but I'll walk through how you would do it with next.js this is all you have to do to integrate Ro ID sign in with nexo so this is in next's configuration page and you can have a list of multiple different providers that can be sign in with Apple sign in with Google sign in with Facebook sign in with worldcoin you have to put in the ID of worldcoin give it the name tell it that it's using ooth uh which open ID connect is built on top of you pass it the URL of our well-known file which tells next doth a lot of the configuration details about worldcoin signin provider you give it this client ID and client secret that you'll get from our developer portal um so I'll actually go ahead and create one right now so you can see where to find those so once you've created a Cloud app you can go to signin your client ID is the same as your app ID and then the client secret you can reset that copy it but don't share that with anybody um and then you'll have to set a redirect urri um depending on what authentication engine you're using that will vary a little bit but it just tells our sign in provider where to direct your user after they've finished the sign-in process so you have to give the client ID and client secret and then you have to map some information returned from our signin provider to NEX Do's internal representation of your user so the ID would be the unique identifier that's the sub user sub from the profile in oidc terms and then we also M the credential type which tells you if your user was verified at the orb or if they verified their phone number in World app those are both the supported credentials within World app but the phone verification is uh a much weaker proof of personhood and proof of uniqueness right because getting multiple phone numbers is fairly easy but it's a way for people to use Sig in with worldcoin if they can't get verified at the orb so now I'll walk a little bit through Anonymous actions these are a lot more flexible but they're a little bit more complex um and these you can use either in a more web 2 fashion with our API or on chain so with Anonymous actions you're getting to know that a user is a unique human doing an action that you specify once it's typically once you can actually have that be as many times as you'd like that could be I want someone to have three accounts on this social media platform that they can Mark is verified and then there's a specific signal that you can include in that proof as well that is just a piece of data that can't be manipulated between when the proof is generated and when it's verified so the flow for anonymous actions is that a user scans the QR code from ID kit our frontend widget on the user's device a zero knowledge proof is generated and then your application receives that proof and verifies it again either with our Epi or on chain depending on your use case and that proof you get is right here so this proof has a Merkel root so the root of the Merkel tree that the user has generated a proof against and that Merkel tree is onchain that's that list of verified identities and that Merkel rout we have and we check against Merkel roots on chain to make sure that it's actually a true Merkel tree of the verified identities and not a Merkel rout that somebody invented this nullifier hash is the unique ident identifier of that user in the context of Your Action so if I perform an action twice with the same world ID it will generate the same nullifier hash which is how we can tell if someone's performed an action before or if they haven't um for signin that nullifier hash is actually that unique identifier of that user that user Sub in oidc terms but if I perform a different action or sign into a different application I get a different nullifier hash which prevents knowing that those two actions were performed by the same person you'll see that the public key of your identity isn't included anywhere in here not even worldcoin can tell which actions you're performing with your world ID this proof is a lot longer than it actually shows here um that is just the actual zero knowledge proof itself and then the credential type will either be phone or orb um and that's just informing the application of if your orb verified or if you have simply just verified your phone number in the app so now I'll show you what using ID kit looks like and I'll also show you our simulator so this is just a little demo page we have oh I need to refresh this so we'll select staging for this let's just say the action is estable we'll accept orb credentials so this continue with World coin button this would be just like the button you would have in your application that would say verify with world ID or something similar so it shows this QR code and in the simulator if I'm running the simulator on my mobile phone I can use the camera to scan the QR code just like I did in the production app but for testing a lot of the times it's easier to run it on your computer here I can actually just click the QR code to copy the link contained within it paste it in here and then I can go ahead and verify so with the simulator every identity here is both phone and orb verifi and you can select at the time of verification which ones you want to test with so let's just treat this like a user that's verified with both I click verify with World ID and we see that it was a successful verification so ID kit if you want to integrate it into your application it's easiest to do as a react component but you can also do so in vanilla JavaScript um in this example I I'm walking through typescript um so we have this one component ID kit widget and there's a handful of parameters that I have to pass to it one is the name of the action and you can configure that in the developer portal the app ID here you also get from our developer portal um and it will be either appcore some long heximal string or if it's staging app will be app staging some long hexadecimal string uh the on success and handle verify parameters are both callback functions that you define handle verify is called immediately after the proof is received from the user uh and if you throw an error in that function it will display within the ID kit model to the user and then on success is called after a um after the verification is complete so if you have both defined um if handle verified throws an error on success doesn't get called uh but handle verify is optional um and for onchain use cases you typically wouldn't use that because in order to verify that proof the user has to send a transaction on chain finally you can set which credential types you want to accept um so that can be an array of these credential type uh like type objects if you're using typescript or if you're using vanilla JavaScript it can just be the string orb and the string phone and then it has this child component that is the button that tells the widget to open so it's pretty simple this one component is really all you need in your front end other than those two callback functions right and this ID kit response this proof return from the user is the input to those callback functions but we've received this proof we do still have to verify that proof just receiving this proof doesn't really mean anything anything everything so far has been in your application's front end the user could always just generate a proof that matches that format but isn't actually meaningful data and pass that to your application and if you don't check that the proof actually verifies then you don't actually know that that user a real unique human so this is what it would look like to verify that proof in your application's backend with our API so this is the offchain use case so at developer. worldcoin org as the base URL AP API V1 verify and then your worldcoin app ID that's our verify endpoint so you send a post request with a Json body um that'll contain everything that was in that response from ID kit additionally you'll need the action and the signal if one was included I did forget to talk about the signal that's also a parameter that you can put into ID kit here um that signal could be like a user's wallet address if they're claiming uh an airdrop gated by World ID just because you know that between when this proof is generated and when you verify the proof if that signal is different between those two steps the proof won't verify um so you can make sure that this piece of information doesn't get tampered with um so you'll include the signal if you had that the action everything returned from ID kit and then if the proof verifies our API responds with the 200 status code and this is where in your back end you should perform whatever action you want to let the user do so that could be marking them as verified in your database or whatever else otherwise you should throw an error if you are doing API verification I'd recommend doing this verification in the handle verify callback function um but you'll need to pass the proof from idit to to your app's backend and then your backend will have to call our API to verify that proof if you want to do onchain verification you'll have to write your smart contract and in the function that does whatever your user wants to do that's gated behind World ID let's just say that's minting some tokens um you'll need to call our smart contracts so if you only have one action that you want the user to perform it's most gas deficient if you set the address of the world ID smart contract the app ID and the action ID all in the Constructor at deployment time um you can also set these as link parameters in the smart contract function um and then we calculate this external nullifier based on the app ID in action World ideas a protocol is built on top of semafor and that external nullifier is what act is the action so we compute the external nullifier by combining the app ID and action ID uh and hashing them in this specific way we do have template repositories for all the examples I'm going through here that implement this properly um so you can just reuse this to calculate the external nullifier and then in this function here you would take in the signal the root of the Merkle tree the nullifier hash and that proof that you receive from ID kit so the first thing we do is check to make sure we haven't seen this nullifier hash before so that we can limit the user to doing this only once for API verification our our API handles tracking that and in the developer portal you can set exactly how many times you want to let someone do a specific action but for onchain use cases you have to track those nullifier hashes yourself so if this nullifier hashes in the list of nullifier hashes that we've seen before let's go ahead and revert we don't want to let the user do this action after we've made sure that they haven't done this action before we call the verify proof function on the world ID smart contract with the root of the Merkel tree uh the group ID which will be zero for orb credentials phone credentials are not supported on chain um so that group ID you can hard code as one or excuse me hard code is zero or set it in your um in your Constructor we have to Hash the signal in a specific way if we use one um otherwise that signal should just be an empty string and then we have the nullifier hash from that proof the external nullifier that is that combination of your app ID and action and then the proof if that proof verifies the function will simply continue if that proof doesn't verify this will revert so finally after we've verified that proof proof we should add this nullifier hash to the list of nullifier hashes we've seen before to prevent the user from doing this again and then you can go ahead and do whatever it is you want your user to be able to do so that's when you would mint those tokens to them or let them claim that nft whatever that may be for your use case so we have $20,000 worth of prizes in this hackathon 5K to the best overall 2500 each to the best governance app most creative use case the best AI use case and the best sign in with worldcoin app we have two honorable mentions of $1,000 each and then a $3,000 prize pool and that's it so if you guys want reference to any of this information that I went over here uh you can go to worldcoin toor Istanbul 23 that also includes links to all of our template repositories and things like that uh and you can also find me at World coins Booth I'll be here basically all weekend if I wasn't here for work I would be here hacking so staying here until 2:3 a.m. is not uncommon for me um and I know that it can be a little unintuitive sometimes so please come ask me for help if there's anything you're confused about any issues you're having and yeah thank you [Applause] guys