Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions world-id/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,10 @@ A user can have only one [NFC Credential](https://docs.world.org/world-id/creden
### Selfie Check

For repeated Selfie Check verification, use `IDKit.createSession` followed by
`IDKit.proveSession` with `.preset(selfieCheck())`.
`IDKit.proveSession` with `.constraints(CredentialRequest("selfie"))`.
IDKit 4.4.0 requires constraints for sessions. For React, use
`constraints={CredentialRequest("selfie")}` on `IDKitSessionWidget` or
`constraints: CredentialRequest("selfie")` in `useIDKitSession`.
Save the verified `session_id` against the application account
and require that same session on later checks; enforce per-proof replay protection.

Expand All @@ -136,7 +139,7 @@ The full code for each step is at [https://docs.world.org/world-id/idkit/integra
The checklist below describes uniqueness requests. For session integrations,
adapt it using `/world-id/idkit/session-proofs`: omit action setup and omit the
action from RP signing,
use `IDKitSessionWidget` or the session builders with presets, and replace
use `IDKitSessionWidget` or the session builders with constraints, and replace
uniqueness-nullifier storage with verified account-to-session binding and
per-proof replay protection. Test both creation and proving the saved session.

Expand Down
6 changes: 3 additions & 3 deletions world-id/idkit/credentials.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -109,20 +109,20 @@ const preset = passport({ signal: "user-123" });

## Proof of Presence (Selfie Check)

Use `selfieCheck()` with [session proofs](/world-id/idkit/session-proofs) to verify
Use `CredentialRequest("selfie")` with [session proofs](/world-id/idkit/session-proofs) to verify
users when they first arrive and when they return. Create a session once, save its
verified `session_id`, then prove that same session on later checks.

Anyone with World ID App can complete the flow—no Orb or document credential is
required.

```typescript
import { IDKit, selfieCheck } from "@worldcoin/idkit-core";
import { IDKit, CredentialRequest } from "@worldcoin/idkit-core";

const request = await IDKit.createSession({
app_id: "app_xxxxx",
rp_context,
}).preset(selfieCheck());
}).constraints(CredentialRequest("selfie"));
```

Follow the [session guide](/world-id/idkit/session-proofs) for the complete
Expand Down
3 changes: 2 additions & 1 deletion world-id/idkit/mini-apps.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,8 @@ The Mini-App-specific details:
| Passport-backed checks | `passport` |

For repeated Selfie Check verification of returning users, use
[session proofs](/world-id/idkit/session-proofs) with the `selfieCheck()` preset.
[session proofs](/world-id/idkit/session-proofs) with
`constraints={CredentialRequest("selfie")}` on `IDKitSessionWidget`.

Check out this [page](/world-id/idkit/credentials) to learn about the different World ID credentials and which preset to use for each.

Expand Down
20 changes: 13 additions & 7 deletions world-id/idkit/session-proofs.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -31,20 +31,25 @@ Generate fresh [RP signatures](/world-id/idkit/signatures) for session creation
each subsequent check. Call `signRequest({ signingKeyHex })` without an `action`;
session requests do not take an action or support legacy proofs.

<Note>
In IDKit 4.4.0, session builders require `.constraints(...)`; `.preset(...)`
throws an error. React session widgets and hooks also require `constraints`.
</Note>

The examples assume `app_id` comes from your Portal configuration and `rp_context`
contains the fresh signature returned by your backend. Use a new `rp_context` for
each example invocation.

## Create a session

```typescript
import { IDKit, selfieCheck } from "@worldcoin/idkit-core";
import { IDKit, CredentialRequest } from "@worldcoin/idkit-core";

const request = await IDKit.createSession({
app_id,
rp_context,
environment: "production",
}).preset(selfieCheck());
}).constraints(CredentialRequest("selfie"));

// Display request.connectorURI as a link or QR code, then wait for the user.
const completion = await request.pollUntilCompletion({ timeout: 120_000 });
Expand All @@ -54,7 +59,7 @@ if (!completion.success) throw new Error(completion.error);
// Save its session_id against the account only after verification succeeds.
```

The `selfieCheck()` preset selects the Selfie Check credential. See
`CredentialRequest("selfie")` selects the Selfie Check credential. See
[Configure Credentials](/world-id/idkit/credentials) for credential options.

Your backend must verify the complete result before saving its `session_id`.
Expand All @@ -68,13 +73,13 @@ Load the saved session ID from your backend for the account being verified, and
obtain a fresh RP signature. Prove that existing session:

```typescript
import { IDKit, selfieCheck } from "@worldcoin/idkit-core";
import { IDKit, CredentialRequest } from "@worldcoin/idkit-core";

const request = await IDKit.proveSession(savedSessionId, {
app_id,
rp_context,
environment: "production",
}).preset(selfieCheck());
}).constraints(CredentialRequest("selfie"));

const completion = await request.pollUntilCompletion({ timeout: 120_000 });
if (!completion.success) throw new Error(completion.error);
Expand All @@ -88,6 +93,7 @@ Preserve it unchanged. Creating a new session on each visit does not establish
continuity with the account's existing session.

For React, use `IDKitSessionWidget` with
`preset={selfieCheck()}`. Omit `existing_session_id` for
creation and set it to the saved session ID for subsequent checks. The widget's
`constraints={CredentialRequest("selfie")}`; import both from `@worldcoin/idkit`.
Omit `existing_session_id` for creation and set it to the saved session ID for
subsequent checks. The widget's
`handleVerify` callback should call your backend before `onSuccess` grants access.
Loading