diff --git a/world-id/SKILL.md b/world-id/SKILL.md index 9004997..48468f3 100644 --- a/world-id/SKILL.md +++ b/world-id/SKILL.md @@ -112,7 +112,10 @@ A user can have only one [NFC Credential](https://docs.world.org/world-id/creden ### Selfie Check For repeated Selfie Check verification, use `IDKit.createSession` followed by -`IDKit.proveSession` with `.preset(selfieCheck())`. +`IDKit.proveSession` with `.constraints(CredentialRequest("selfie"))`. +IDKit 4.4.0 requires constraints for sessions. For React, use +`constraints={CredentialRequest("selfie")}` on `IDKitSessionWidget` or +`constraints: CredentialRequest("selfie")` in `useIDKitSession`. Save the verified `session_id` against the application account and require that same session on later checks; enforce per-proof replay protection. @@ -136,7 +139,7 @@ The full code for each step is at [https://docs.world.org/world-id/idkit/integra The checklist below describes uniqueness requests. For session integrations, adapt it using `/world-id/idkit/session-proofs`: omit action setup and omit the action from RP signing, -use `IDKitSessionWidget` or the session builders with presets, and replace +use `IDKitSessionWidget` or the session builders with constraints, and replace uniqueness-nullifier storage with verified account-to-session binding and per-proof replay protection. Test both creation and proving the saved session. diff --git a/world-id/idkit/credentials.mdx b/world-id/idkit/credentials.mdx index b0501fe..4d463b1 100644 --- a/world-id/idkit/credentials.mdx +++ b/world-id/idkit/credentials.mdx @@ -109,7 +109,7 @@ const preset = passport({ signal: "user-123" }); ## Proof of Presence (Selfie Check) -Use `selfieCheck()` with [session proofs](/world-id/idkit/session-proofs) to verify +Use `CredentialRequest("selfie")` with [session proofs](/world-id/idkit/session-proofs) to verify users when they first arrive and when they return. Create a session once, save its verified `session_id`, then prove that same session on later checks. @@ -117,12 +117,12 @@ Anyone with World ID App can complete the flow—no Orb or document credential i required. ```typescript -import { IDKit, selfieCheck } from "@worldcoin/idkit-core"; +import { IDKit, CredentialRequest } from "@worldcoin/idkit-core"; const request = await IDKit.createSession({ app_id: "app_xxxxx", rp_context, -}).preset(selfieCheck()); +}).constraints(CredentialRequest("selfie")); ``` Follow the [session guide](/world-id/idkit/session-proofs) for the complete diff --git a/world-id/idkit/mini-apps.mdx b/world-id/idkit/mini-apps.mdx index b8166c3..72b1e23 100644 --- a/world-id/idkit/mini-apps.mdx +++ b/world-id/idkit/mini-apps.mdx @@ -41,7 +41,8 @@ The Mini-App-specific details: | Passport-backed checks | `passport` | For repeated Selfie Check verification of returning users, use -[session proofs](/world-id/idkit/session-proofs) with the `selfieCheck()` preset. +[session proofs](/world-id/idkit/session-proofs) with +`constraints={CredentialRequest("selfie")}` on `IDKitSessionWidget`. Check out this [page](/world-id/idkit/credentials) to learn about the different World ID credentials and which preset to use for each. diff --git a/world-id/idkit/session-proofs.mdx b/world-id/idkit/session-proofs.mdx index a8d9404..8e07609 100644 --- a/world-id/idkit/session-proofs.mdx +++ b/world-id/idkit/session-proofs.mdx @@ -31,6 +31,11 @@ Generate fresh [RP signatures](/world-id/idkit/signatures) for session creation each subsequent check. Call `signRequest({ signingKeyHex })` without an `action`; session requests do not take an action or support legacy proofs. + + In IDKit 4.4.0, session builders require `.constraints(...)`; `.preset(...)` + throws an error. React session widgets and hooks also require `constraints`. + + The examples assume `app_id` comes from your Portal configuration and `rp_context` contains the fresh signature returned by your backend. Use a new `rp_context` for each example invocation. @@ -38,13 +43,13 @@ each example invocation. ## Create a session ```typescript -import { IDKit, selfieCheck } from "@worldcoin/idkit-core"; +import { IDKit, CredentialRequest } from "@worldcoin/idkit-core"; const request = await IDKit.createSession({ app_id, rp_context, environment: "production", -}).preset(selfieCheck()); +}).constraints(CredentialRequest("selfie")); // Display request.connectorURI as a link or QR code, then wait for the user. const completion = await request.pollUntilCompletion({ timeout: 120_000 }); @@ -54,7 +59,7 @@ if (!completion.success) throw new Error(completion.error); // Save its session_id against the account only after verification succeeds. ``` -The `selfieCheck()` preset selects the Selfie Check credential. See +`CredentialRequest("selfie")` selects the Selfie Check credential. See [Configure Credentials](/world-id/idkit/credentials) for credential options. Your backend must verify the complete result before saving its `session_id`. @@ -68,13 +73,13 @@ Load the saved session ID from your backend for the account being verified, and obtain a fresh RP signature. Prove that existing session: ```typescript -import { IDKit, selfieCheck } from "@worldcoin/idkit-core"; +import { IDKit, CredentialRequest } from "@worldcoin/idkit-core"; const request = await IDKit.proveSession(savedSessionId, { app_id, rp_context, environment: "production", -}).preset(selfieCheck()); +}).constraints(CredentialRequest("selfie")); const completion = await request.pollUntilCompletion({ timeout: 120_000 }); if (!completion.success) throw new Error(completion.error); @@ -88,6 +93,7 @@ Preserve it unchanged. Creating a new session on each visit does not establish continuity with the account's existing session. For React, use `IDKitSessionWidget` with -`preset={selfieCheck()}`. Omit `existing_session_id` for -creation and set it to the saved session ID for subsequent checks. The widget's +`constraints={CredentialRequest("selfie")}`; import both from `@worldcoin/idkit`. +Omit `existing_session_id` for creation and set it to the saved session ID for +subsequent checks. The widget's `handleVerify` callback should call your backend before `onSuccess` grants access.