========================================================================
World's latest products: IDP vs IDKit
Speaker: Mateo Sauton & Aurelien Brezun — Tools for Humanity
ETHGlobal Tokyo 2026 · Workshop · Friday, September 25, 2026
Video: https://www.youtube.com/watch?v=MElIfoDffuw
Transcribed with aloha by the AI ʻohana 🌺
========================================================================

[00:00] Hi, everybody. My name is Orel, and this is Matteo, and today we will present our latest
[00:15] product, both SDK that allows you to integrate World ID in your application and an OIDC identity
[00:21] provider that allows you to integrate World ID in your authentication stack. So first,
[00:27] Matteo.
[00:28] Hey, hello, guys. Yeah, I'll just one sec. We both work at Tools for Humanity. It's
[00:35] a company building product for World, or you might know us, Worldcoin. I'm going to start
[00:43] talking about the problems that we're solving. So probably all of you know what's happening
[00:49] in the Internet. It's packed with bots, and it's not great. Almost half of the traffic
[00:56] in the Internet, it's been done by bots. And that brings up our problems for us. And this
[01:05] is one of my favorite quotes. This happened early this year. Peter Steinberger, the guy
[01:10] that created Open Claw, he said in one of the most famous podcasts in the world from
[01:17] Lex Fritman, he said that he saw his agent happily click, I am not a robot button.
[01:24] For me, that moment, I understood that everything we did before was amazing, but that moment
[01:30] was my aha moment, and I knew new things were coming for World ID as a product. So that
[01:38] is the we need a proof of human moment for me. And that's what we, at least we want
[01:44] you to exit this room getting the idea of what that is. Why we need a proof of human.
[01:51] First, what is a proof of human? So proof of human, it's basically privacy-persevering
[01:59] proof that you are a human, of course, online. And it's not only that you are a human, it's
[02:08] also that you are a unique human. And that unlocks a lot of possibilities. So proof of
[02:14] human, again, is the way that you as a person interacting in the Internet, you can
[02:21] prove that you are unique and that you are a human. What we want from you from this hackathon
[02:27] is to build products and projects on top of that primitive, okay? And we solve a few things
[02:36] that I think this might be interesting for you as inspiration. We solve impersonation,
[02:42] for example, with deepfake solution that we are working with. Sybil attacks, we prove
[02:50] that you are a human and you are unique, so you are not a bot, okay? So that's another
[02:56] proof that you can show. We can control scale of uses and we can control fake accounts.
[03:03] Since again, if you are unique, you got your unique human ID, you cannot create a million
[03:09] accounts because they will all be gated for the same person. Yep, there we go. So this
[03:16] is World. World is a project co-created by, co-founded by Sam Altman and Alex Blania where
[03:24] more than 39 million users already downloaded WorldApp. 19 million of them got orb verified,
[03:31] which I will talk about in a few seconds, in more than 160 countries. And the main and
[03:39] core product that we have is World ID, okay? Again, this is the privacy-preserving ID that
[03:45] you can show in different places, websites, products, et cetera, that will basically tell
[03:52] them that you are a unique human and that can unlock a lot of benefits. It's, again,
[03:57] a privacy-preserving protocol. It helps you, as developers, build trust in your products
[04:03] and uses a very secure architecture using zero-knowledge proof to prove for actually emitting
[04:10] these proofs, okay? So nothing is compromised on any end. Let's go. There you go. And we
[04:23] built proof of World ID initially just for orb verification method, which is the highest
[04:31] assurance level that we have. So basically, a user goes to an orb, which we have in the
[04:38] booth over there that you can go and see, and you can go and verify, of course, which
[04:43] basically creates this concept of unique humans, right? But we understood that this is not
[04:50] available for everyone, everywhere. So we needed to create new products, which are the new
[04:57] latest products that we have, official IDs, which basically allows users from certain countries
[05:04] with supported document-like passports to, at some point, scan their NFC ID in their passport
[05:11] and, again, using CK proofs, prove that they are, for example, a citizen from X country, okay?
[05:18] And we built a product called Identity Attestations, an identity check that basically lets you prove
[05:25] attestations. For example, I am Argentinian, so I can prove in your website or your products
[05:32] that I am Argentinian, and you can use that to, for example, if you don't like Argentinians,
[05:37] you can get Argentinians out of this product. And the third product that we created is selfie
[05:43] check. So it's the lowest assurance method, but also lowest friction, so anyone can
[05:51] use their phone camera and check the selfie from the camera and the selfie that your
[05:58] device is taking, or you took before, to check that there is a human behind. One more. Okay.
[06:07] And how can you use all these products? You use it through IDkit, which is our SDK. I will talk
[06:14] about IDkit. This guy is going to talk about the World ID for Agents, which is much cooler
[06:18] than what I do, but I'm cooler. Just kidding. So basically, IDkit is this thing that enables
[06:25] you to use orb verification, identity check, or passport check, and selfie check. And not only that,
[06:36] you can also use face off, which is another product that we have. So basically face off
[06:41] compares, if you, I don't know, if you verify it with an orb, for example, face off compares
[06:48] that image, okay, with the selfie that's being taken at this precise moment. So you can check
[06:54] if this is the same person that the orb saw at that moment. Again, selfie check is the other
[07:00] product that I mentioned to you. So you can, a lowest assurance, lowest friction method that
[07:05] you can use for everyone to access your platform, or you can create different tiers in your platform
[07:11] based on the different credentials that you are creating. Document credentials, as I mentioned.
[07:17] Target audiences for certain countries is not live for every country. So we will be rolling more and
[07:25] more of these for more countries later. But for now, it's I think 35 or 25 different countries
[07:32] in the world. And again, you can prove different attestations from this passports without
[07:38] revealing information. One more, press it, boom. And all of this, you can access it through our new
[07:51] World ID app. If you all know the project from before, we had this huge and beautiful app called
[07:58] World App. We separate that into two. World ID app is the one that lets you do all these proofs.
[08:06] And World Money app that we released that last week, actually, in a lot of press releases and cool
[08:14] things. That basically is the way that you as humans can interact with world chain, mini apps,
[08:22] and the financial section of the company. Now, I'll speak about World ID for Agents,
[08:33] which is the second product that we have, which is much cooler. So basically, we have a lot of
[08:42] products. I mentioned like five or six different ones, but we didn't want to get outside of the
[08:48] agentic world. We built Agent Kit, which basically let you delegate your World ID to your agents.
[08:58] But we thought, okay, this is not good enough. We want to let you do more things. So we created
[09:06] this with this in mind. A tool is needed to power the agentic economy and ensure human
[09:11] continuity for it. So basically, what we did is, and on top of OIDC, great, that's a
[09:21] protocol that you all know, right? You need to respond when I ask, right? If you don't,
[09:28] you should say, no, I will say, okay, I will explain OIDC. But you all know it. Okay, shit.
[09:34] It's a protocol on top of OAuth. Like OAuth is a protocol you're using for your authentication
[09:39] stack. You can federate our identity provider with your current authentication stack, such that
[09:44] you can do step up authentication, for example. So if a human is logging into your application,
[09:52] and you want to offer some sort of free tier or higher rate limit or whatever,
[09:56] they can connect the World ID such that they can be granted those higher tiers. And for you,
[10:02] you get a private identifier, which is stable per human. So if a human creates like 50 different
[10:09] accounts, you can recognize that it's the same human behind them. This is like the value prop,
[10:16] and it's compatible with any authentication solution that's available, like O0, Amazon
[10:21] or whatever you're using in your application. Yeah, that's huge. And it also works with MCP
[10:29] servers. MCP supports a single authentication protocol currently, and it is OAuth. So you can
[10:35] integrate IDP with your current MCP servers. And MCP servers also support step up authentication. So
[10:42] when your application requires this extra assurance, they can send a challenge back to the user's
[10:49] agent, and then the agent can prompt the user to connect their World ID. So it kind of also solves
[10:55] human in the loop, but also it's just this basic trust signal, so that you can be sure that one
[11:02] human is not just going to abuse your application with like 100 different agents accessing your
[11:06] service. Yeah, and we thought about this, and we talked with a lot of partners about this.
[11:13] And one of them was super cool about it. I know, ah, one back. There we go. And I don't know if you
[11:20] know from Twitter, probably Monet. It's a huge AI company that's building cool stuff. And we
[11:27] partnered with them to give you for the hackathon $20 in Monet to see, we'll have a QR code for
[11:35] later, so you can get your phones later. We have like a lot of QR codes. So basically,
[11:42] you can follow these steps. Basically, it's just applying a promo code. Only for unique
[11:47] humans, actually, it's for you from the hackathon, you get $20 to use Monet in the hack. I mean,
[11:54] not you, your agent does, but you get it. No, yes, go for the QRs. Everyone loves QRs.
[12:00] Let's go. Okay, so world ID docs. So if you want to integrate ID kit, you'll go for the first QR code.
[12:08] If you want to integrate the world ID for agents, you'll go for the second QR code.
[12:13] If you want $20 in Monet credits, you'll go for the third QR code. Of course, everything is
[12:20] in the world like price thing. So if you don't want to do QR codes, you can also click links
[12:29] in the website. Yeah, I think that's almost it. I love this. So there we go. Change
[12:46] entire screen. Start mirroring. Yes. Okay, so a friend of mine built a website for restaurant
[12:55] reservations in SF. And the problem with restaurant reservation is some restaurants are very hard to
[13:00] get into and bots are basically snatching all those spots in advance and then they can result.
[13:07] So my friend built this app and in order to pass a reservation, you need to be a verified
[13:11] unique human and this app is also compatible with agents. So I'm going to ask Codex to just book me
[13:18] a table. Book me a table for a test using matrix. So Codex is going to talk to this application
[13:30] over the application MTP server. And we should put like elevator music right now, like
[13:40] or something while he's working. Codex thinks the restaurant is called text.
[13:44] Oh, no, no, it's not this bro.
[13:53] Any restaurant.
[14:01] I use teller because it's cheaper. Anytime is fine.
[14:14] There we go. Anyway, so for all of this, I'm still not authenticated to this application.
[14:23] And when the application actually gets to the point where I need to book,
[14:27] it's going to check whether I've already connected my world ID or not.
[14:31] And if it doesn't, the MTP should send back a challenge. Exactly. And then Codex is
[14:38] picking up the challenge over MTP and then it's asking me to connect my world ID.
[14:47] All right. So I just connect my world ID. You just basically killed anyone that wanted to build
[14:53] the booking restaurant tables app. You know that, right? Just kidding.
[15:00] Okay, it's done.
[15:07] So Codex has seen that I have completed the verification
[15:10] and now the relying party, so the application
[15:13] has gotten this table identifier,
[15:15] so it is able to recognize me as a unique human
[15:19] and it can also see whether I have a single account
[15:21] or 50 different accounts, right?
[15:24] And so it's done, like the restaurant is booked
[15:27] and we can verify.
[15:28] And the important thing is that
[15:30] it's a one-time verification, right?
[15:32] Like if I book another table,
[15:35] I won't have to do that verification again.
[15:39] And now I'm going into the UI
[15:42] and you can see like my wallet is connected
[15:45] and the restaurant is booked.
[15:48] And that's the value proposition.
[15:50] The wallet for agents.
[15:54] Let's go.
[15:55] Live demos, man.
[15:56] I love this.
[15:58] And so this entire flow would have been possible
[16:00] as well in the browser.
[16:01] Like you don't have to use an agent
[16:03] to use wallet for agents.
[16:04] You can actually just,
[16:05] if you're a human, you can just go to the browser.
[16:09] And then lastly, we have this.
[16:13] So this works, the IDP works as a single sign-on.
[16:16] So once you're logged in the IDP,
[16:18] you don't have to verify a proof
[16:20] every time you connect to a different application.
[16:24] So once you're connected in the IDP,
[16:27] you can also manage your application.
[16:29] You can see which application I've accessed
[16:34] your wallet ID, you can rework and all of this.
[16:37] And then you can see like your sessions,
[16:39] your agents and all that stuff.
[16:43] And so basically on Sandbox,
[16:45] like Sandbox use fake identities.
[16:47] So for the hackathon,
[16:48] please like don't spend any real money on this.
[16:50] Or like if you already have a production app
[16:54] and you want to grant some free tier or whatever,
[16:57] like keep them on small
[16:59] because it's fake identities,
[17:00] like a single human can create many,
[17:02] many different wallet ID.
[17:04] Obviously when it's in prod,
[17:06] this will be like this problem does not exist.
[17:09] And so we're basically,
[17:11] we're curious on how you will integrate
[17:13] this product in your application.
[17:15] Since it's an IDP,
[17:17] it can work as a primary authentication provider,
[17:19] but we're not that like we're not trying at all
[17:22] to compete with Google sign-in or Apple sign-in
[17:24] because we don't have first name,
[17:26] last name or email address.
[17:27] Like we don't have all that information.
[17:28] We just provide a stable private identifier per humans.
[17:32] That's it.
[17:33] So my thinking about this is that
[17:36] it fits into a step up authentication flow
[17:39] where a user wants to do something that is gated
[17:42] behind like an extra assurance signal.
[17:45] And this is at that point that the application requires,
[17:49] like triggers a step up as flow.
[17:51] But again, like be creative if,
[17:53] like we're super curious
[17:54] on how you could use that in your application.
[17:58] And that's a wrap.
[18:01] Thank you.
[18:05] I mean, if you have any questions, we can, yeah.
[18:12] Wait, one.
[18:15] If you have questions related to your products,
[18:17] let's go talk outside.
[18:19] Cause minor.
[18:30] Yeah, I mean.
[18:33] Yeah, sure.
[18:35] Yeah, yeah, yeah.
[18:36] I need word ID.
[18:38] But you can use sandbox app.
[18:40] Sandbox is fine.
[18:41] We have a sandbox app.
[18:44] So you can create identities and sandbox.
[18:46] So no production.
[18:48] And you can be a minor and use it,
[18:50] but it's not real proofs.
[18:51] It's sandbox.
[18:53] Yep, yep.
[18:55] Sure.
[18:59] Actually, no, but we have a simulator for that.
[19:03] Come and talk on the booth and I'll send you the link.
[19:06] It's actually also in the website for world,
[19:09] but I can show you the,
[19:11] where you can generate sandbox proofs for passport.
[19:16] Yeah, yep.
[19:28] Yeah.
[19:39] By codecs, you mean,
[19:45] I've never thought about this, actually.
[19:47] I've never thought about this.
[19:48] I don't know.
[20:00] The thing is, okay.
[20:05] I was already logged in this application with Gmail.
[20:09] So Maitre used like Google, like Google sign-in.
[20:13] So when I logged in,
[20:15] I had already an account with them,
[20:16] but my word ID was not connected.
[20:18] So the moment I connected my word ID,
[20:21] what the app did is just add a row in the table thing.
[20:25] This is private ID.
[20:26] And now they can dig up.
[20:28] If I have many Gmail account, like I have several,
[20:32] if I log in with another Gmail account
[20:34] and connect my word ID,
[20:35] they will know those two people are the same, right?
[20:38] It should work with cloud and like all the agents,
[20:40] we haven't tried, but yeah.
[20:44] Yeah.
[21:02] So for the demo app,
[21:04] my friend is using Superbase
[21:06] as its authentication provider.
[21:09] And the IDP can be federated.
[21:12] So in Superbase, there's a setting where you can say,
[21:14] use external IDP, whatever.
[21:16] You just plug the URL and you're good to go.
[21:35] No, this flow works on top of OAuth, right?
[21:39] And sign-in with Ethereum does not,
[21:41] I would need to check,
[21:43] I'm 99% sure it's not working on top of OAuth.
[21:47] OAuth is the Web2 protocol.
[21:49] So yeah.
[22:00] You mean our product, like our IDP?
[22:04] You can actually, but you get,
[22:07] yeah, I mean, you don't get people's name, right?
[22:10] If you don't care about people's name,
[22:11] you can absolutely use it for signing in your application.
[22:15] You can kind of think of it this way.
[22:34] And of course the code that's on your phone
[22:38] is going to be very different than the code
[22:39] that the application is going to get for privacy reasons.
[22:42] Like the IDP gives pairwise subject.
[22:44] That means every applications gets a different ID.
[22:48] So that if you visit, I don't know,
[22:49] May 3 and Facebook, if both of them use well ID,
[22:53] they will not be able to correlate traffic.
[22:57] They will not get the same ID for a given year.
[22:59] But anyhow, you could use this
[23:02] for your authentication needs, definitely.