Skip to content

docs for credential refresh / issuance for PoH#38

Open
carlomazzaferro wants to merge 6 commits intomainfrom
feat/poh-credential-and-refresh-docs
Open

docs for credential refresh / issuance for PoH#38
carlomazzaferro wants to merge 6 commits intomainfrom
feat/poh-credential-and-refresh-docs

Conversation

@carlomazzaferro
Copy link

@carlomazzaferro carlomazzaferro commented Feb 5, 2026

Summary

  • Add Credential Issuance section with /api/v1/refresh documentation and detailed credential format.
  • Add new Credential reference page covering schema, serialization, hashing/signature, and PoH-specific usage.
  • Update World ID navigation and core concepts with issuer/credential definitions and spec links.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c397847db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

"group": "Sign in with World ID",
"pages": ["world-id/sign-in/oidc"]
},
{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's create a new section altogether for the PoH Issuer. @andy-t-wang sg?

Image

- **App ID**: The ID of your app that is assigned in our [Developer Portal](https://developer.worldcoin.org/).
- **Action**: A developer-facing primitive that lets you put any app operation behind a unique-human gate. An app can have one or more actions depending on your use case.
- **Issuer**: An entity authorized to issue a credential for a specific schema. Issuers sign credentials and publish their public keys in the `CredentialSchemaIssuerRegistry`.
- **Credential**: A signed attestation about a subject used to generate proofs. It includes issuer, subject, validity window, and claim commitments as defined in the [World ID 4.0 specs](https://github.com/worldcoin/world-id-protocol/tree/main/docs/world-id-4-specs)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's point instead to the source of truth for what is a credential, https://docs.rs/world-id-primitives/latest/world_id_primitives/credential/struct.Credential.html

@@ -0,0 +1,128 @@
---
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we take the general information and move it to the protocol repo? perhaps it's worth having a generic Credential page here, but it should be fully separate from the PoH-specific definitions

"twitter:image": "/images/docs/docs-meta.png"
---

This endpoint issues a new proof-of-human (PoH) credential to a holder of a valid World ID. It can re-verify with a Personal Custody Package (PCP) or issue a credential-only refresh when a PCP is not available.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not clear that this endpoint is only intended for v3 users to get their v4 credential


The `credential` response field is a base64-encoded JSON representation of the World ID `Credential` object defined in `world-id-protocol/crates/primitives/src/credential.rs`.

### Decoding
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd drop this section, it's generally self-explanatory with the Credential struct and it may easily become outdated

- **Issuer public key** (`issuer.pk`) is serialized as `[x, y]` decimal strings for BabyJubJub affine coordinates.
- **Signature** is hex-encoded compressed bytes (no `0x` prefix).

### PoH-specific claims
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is super important to document, but let's keep it only in a single place

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants