Struct Authenticator 

pub struct Authenticator { /* private fields */ }

The Authenticator is the main component with which users interact with the World ID Protocol.

Implementations

impl Authenticator

pub fn init_storage(&self, now: u64) -> Result<(), WalletKitError>

Initializes storage using the authenticator’s leaf index.

Errors

Returns an error if the leaf index is invalid or storage initialization fails.

pub fn destroy_storage(&self) -> Result<(), WalletKitError>

Permanently destroys all credential storage data.

Removes the encryption keys, vault database, and cache database. After this call the authenticator can no longer generate proofs or access stored credentials. Intended for logout or account deletion.

Errors

Returns an error if the storage destruction fails.

impl Authenticator

pub async fn init_with_config( seed: &[u8], config: Config, materials: Arc<Groth16Materials>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and an already-parsed Config.

Errors

See CoreAuthenticator::init for potential errors.

impl Authenticator

pub fn packed_account_data(&self) -> Uint256

Returns the packed account data for the holder’s World ID.

The packed account data is a 256 bit integer which includes the user’s leaf index, their recovery counter, and their pubkey id/commitment.

pub fn leaf_index(&self) -> u64

Returns the leaf index for the holder’s World ID.

This is the index in the Merkle tree where the holder’s World ID account is registered. It should only be used inside the authenticator and never shared.

pub fn onchain_address(&self) -> String

Returns the Authenticator’s onchain_address.

See world_id_core::Authenticator::onchain_address for more details.

pub async fn get_packed_account_data_remote( &self, ) -> Result<Uint256, WalletKitError>

Returns the packed account data for the holder’s World ID fetching it from the on-chain registry.

Errors

Will error if the provided RPC URL is not valid or if there are RPC call failures.

pub async fn generate_credential_blinding_factor_remote( &self, issuer_schema_id: u64, ) -> Result<FieldElement, WalletKitError>

Generates a blinding factor for a Credential sub (through OPRF Nodes).

See CoreAuthenticator::generate_credential_blinding_factor for more details.

Errors

• Will generally error if there are network issues or if the OPRF Nodes return an error.
• Raises an error if the OPRF Nodes configuration is not correctly set.

pub fn compute_credential_sub( &self, blinding_factor: &FieldElement, ) -> FieldElement

Compute the sub for a credential from the authenticator’s leaf index and a blinding_factor.

pub fn danger_sign_challenge( &self, challenge: &[u8], ) -> Result<Vec<u8>, WalletKitError>

Signs an arbitrary challenge with the authenticator’s on-chain key.

Warning

This is considered a dangerous operation because it leaks the user’s on-chain key, hence its leaf_index. The only acceptable use is to prove the user’s leaf_index to a Recovery Agent. The Recovery Agent is the only party beyond the user who needs to know the leaf_index.

Errors

May error if very unexpectedly the signing process fails. Not expected.

pub async fn danger_sign_initiate_recovery_agent_update( &self, new_recovery_agent: String, ) -> Result<RecoveryUpdateSignature, WalletKitError>

Signs the EIP-712 InitiateRecoveryAgentUpdate payload and returns the raw signature bytes and signing nonce without submitting anything to the gateway.

This is the signing-only counterpart of Self::initiate_recovery_agent_update. Callers can use the returned bytes to build and submit the gateway request themselves.

Warning

This method uses the onchain_signer (secp256k1 ECDSA) and produces a recoverable signature. Any holder of the signature together with the EIP-712 parameters can call ecrecover to obtain the onchain_address, which can then be looked up in the registry to derive the user’s leaf_index. Only expose the output to trusted parties (e.g. a Recovery Agent).

Arguments

• new_recovery_agent — the checksummed hex address of the new recovery agent (e.g. "0x1234…").

Errors

• Returns WalletKitError::InvalidInput if new_recovery_agent is not a valid address.
• Returns an error if the nonce fetch or signing step fails.

pub async fn initiate_recovery_agent_update( &self, new_recovery_agent: String, ) -> Result<String, WalletKitError>

Initiates a time-locked recovery agent update (14-day cooldown).

Signs an EIP-712 InitiateRecoveryAgentUpdate payload and submits it to the gateway. Returns the gateway request ID that can be used to poll status.

Arguments

• new_recovery_agent — the checksummed hex address of the new recovery agent (e.g. "0x1234…").

Errors

• Returns WalletKitError::InvalidInput if new_recovery_agent is not a valid address.
• Returns a network error if the gateway request fails.

pub async fn execute_recovery_agent_update( &self, ) -> Result<String, WalletKitError>

Executes a pending recovery agent update after the 14-day cooldown has elapsed.

This call is permissionless — no signature is required. The contract enforces the cooldown and will revert with RecoveryAgentUpdateStillInCooldown if called too early.

Returns the gateway request ID that can be used to poll status.

Errors

Returns a network error if the gateway request fails.

pub async fn cancel_recovery_agent_update( &self, ) -> Result<String, WalletKitError>

Cancels a pending time-locked recovery agent update before the cooldown expires.

Signs an EIP-712 CancelRecoveryAgentUpdate payload and submits it to the gateway. Returns the gateway request ID that can be used to poll status.

Errors

Returns a network error if the gateway request fails.

impl Authenticator

pub async fn init_with_defaults( seed: &[u8], rpc_url: Option<String>, environment: &Environment, region: Option<Region>, materials: Arc<Groth16Materials>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and with SDK defaults.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

See CoreAuthenticator::init for potential errors.

pub async fn init_with_ohttp_defaults( seed: &[u8], rpc_url: Option<String>, environment: &Environment, region: Option<Region>, materials: Arc<Groth16Materials>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed using SDK defaults routed through the OHTTP relay. Opt-in alternative to Authenticator::init_with_defaults.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

See CoreAuthenticator::init for potential errors.

pub async fn init( seed: &[u8], config: &str, materials: Arc<Groth16Materials>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and config.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

Will error if the provided seed is not valid or if the config is not valid.

pub async fn generate_proof( &self, proof_request: &ProofRequest, now: Option<u64>, ) -> Result<ProofResponse, WalletKitError>

Generates a proof for the given proof request.

Errors

Returns an error if proof generation fails.

pub async fn prove_credential_sub( &self, nonce: &FieldElement, blinding_factor: &FieldElement, sub: &FieldElement, ) -> Result<OwnershipProof, WalletKitError>

Generates a WIP-103 Ownership Proof for Issuers.

An Ownership Proof lets the user prove they own the credential sub associated with a stored credential without revealing their leaf_index.

Security-critical usage constraint

This method MUST only be called as part of a direct user-initiated action in the client. Callers MUST NOT expose this method to issuer-triggered, backend-triggered, or unauthenticated request flows.

Arguments

• nonce - A field element provided by the Issuer to prevent replay.
• blinding_factor - The credential blinding factor previously used to derive the credential sub.
• sub - The credential sub (commitment) to prove ownership of.

Errors

• Returns WalletKitError::InvalidInput if blinding_factor and sub are inconsistent with each other (i.e. sub was not derived from this authenticator’s leaf index and the provided blinding factor).
• Returns a network error if the Merkle inclusion proof cannot be fetched from the indexer.
• Returns WalletKitError::ProofGeneration if the ZK proof fails.

Trait Implementations

impl Debug for Authenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<UT> LiftRef<UT> for Authenticator

type LiftType = Arc<Authenticator>

impl<UT> LowerError<UT> for Authenticator

fn lower_error(obj: Self) -> RustBuffer

Lower this value for scaffolding function return

impl<UT> LowerReturn<UT> for Authenticator

type ReturnType = <Arc<Authenticator> as LowerReturn<UniFfiTag>>::ReturnType

The type that should be returned by scaffolding functions for this type.

fn lower_return(obj: Self) -> Result<Self::ReturnType, RustCallError>

Lower the return value from an scaffolding call

fn handle_failed_lift( error: LiftArgsError, ) -> Result<Self::ReturnType, RustCallError>

Lower the return value for failed argument lifts

impl<UT> TypeId<UT> for Authenticator

const TYPE_ID_META: MetadataBuffer