Struct Authenticator 

pub struct Authenticator { /* private fields */ }

The Authenticator is the main component with which users interact with the World ID Protocol.

Implementations

impl Authenticator

pub fn init_storage(&self, now: u64) -> Result<(), WalletKitError>

Initializes storage using the authenticator’s leaf index.

Errors

Returns an error if the leaf index is invalid or storage initialization fails.

pub fn destroy_storage(&self) -> Result<(), WalletKitError>

Permanently destroys all credential storage data.

Removes the encryption keys, vault database, and cache database. After this call the authenticator can no longer generate proofs or access stored credentials. Intended for logout or account deletion.

Errors

Returns an error if the storage destruction fails.

impl Authenticator

pub async fn init_with_config( seed: &[u8], config: Config, artifacts: Arc<dyn WalletKitZkArtifactSource>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and an already-parsed Config.

Errors

See CoreAuthenticator::init for potential errors.

impl Authenticator

pub fn packed_account_data(&self) -> Uint256

Returns the packed account data for the holder’s World ID.

The packed account data is a 256 bit integer which includes the user’s leaf index, their recovery counter, and their pubkey id/commitment.

pub fn leaf_index(&self) -> u64

Returns the leaf index for the holder’s World ID.

This is the index in the Merkle tree where the holder’s World ID account is registered. It should only be used inside the authenticator and never shared.

pub fn onchain_address(&self) -> String

Returns the Authenticator’s onchain_address.

See world_id_core::Authenticator::onchain_address for more details.

pub async fn get_packed_account_data_remote( &self, ) -> Result<Uint256, WalletKitError>

Returns the packed account data for the holder’s World ID fetching it from the on-chain registry.

Errors

Will error if the provided RPC URL is not valid or if there are RPC call failures.

pub async fn generate_credential_blinding_factor_remote( &self, issuer_schema_id: u64, ) -> Result<FieldElement, WalletKitError>

Generates a blinding factor for a Credential sub (through OPRF Nodes).

See CoreAuthenticator::generate_credential_blinding_factor for more details.

Errors

• Will generally error if there are network issues or if the OPRF Nodes return an error.
• Raises an error if the OPRF Nodes configuration is not correctly set.

pub fn compute_credential_sub( &self, blinding_factor: &FieldElement, ) -> FieldElement

Compute the sub for a credential from the authenticator’s leaf index and a blinding_factor.

pub fn danger_sign_challenge( &self, challenge: Vec<u8>, ) -> Result<Vec<u8>, WalletKitError>

Signs an arbitrary challenge with the authenticator’s on-chain key.

Warning

This is considered a dangerous operation because it leaks the user’s on-chain key, hence its leaf_index. The only acceptable use is to prove the user’s leaf_index to a Recovery Agent. The Recovery Agent is the only party beyond the user who needs to know the leaf_index.

Errors

May error if very unexpectedly the signing process fails. Not expected.

pub async fn danger_sign_initiate_recovery_agent_update( &self, new_recovery_agent: String, ) -> Result<RecoveryUpdateSignature, WalletKitError>

Signs the EIP-712 InitiateRecoveryAgentUpdate payload and returns the raw signature bytes and signing nonce without submitting anything to the gateway.

Callers can use the returned bytes to build and submit the gateway request themselves.

Warning

This method uses the onchain_signer (secp256k1 ECDSA) and produces a recoverable signature. Any holder of the signature together with the EIP-712 parameters can call ecrecover to obtain the onchain_address, which can then be looked up in the registry to derive the user’s leaf_index. Only expose the output to trusted parties (e.g. a Recovery Agent).

Arguments

• new_recovery_agent — the checksummed hex address of the new recovery agent (e.g. "0x1234…").

Errors

• Returns WalletKitError::InvalidInput if new_recovery_agent is not a valid address.
• Returns an error if the nonce fetch or signing step fails.

pub async fn update_recovery_agent( &self, new_recovery_agent: String, ) -> Result<String, WalletKitError>

Updates the holder’s recovery agent (WIP-102).

On a V2 registry the new agent becomes effective immediately, but for a revert window any authenticator can call Self::revert_recovery_agent_update to roll back. During that window the previous agent remains the only valid signer for recoverAccount, which mitigates a compromised authenticator silently swapping in an attacker-controlled recovery address.

Arguments

• new_recovery_agent — the checksummed hex address of the new recovery agent (e.g. "0x1234…").

Errors

• Returns WalletKitError::InvalidInput if new_recovery_agent is not a valid address.
• Returns a network error if the gateway request fails.

pub async fn revert_recovery_agent_update( &self, ) -> Result<String, WalletKitError>

Reverts an in-flight recovery agent update during the revert window (WIP-102).

Must be called within the revert window after Self::update_recovery_agent. During that window any authenticator can revert the update; the previous recovery agent stays effective until the window expires.

Signs an EIP-712 CancelRecoveryAgentUpdate payload (the typehash is reused on V2) and submits it to the gateway.

Errors

Returns a network error if the gateway request fails.

pub async fn insert_authenticator( &self, new_authenticator_pubkey: String, new_authenticator_address: String, ) -> Result<String, WalletKitError>

Inserts an authenticator into the holder’s World ID account.

Arguments

• new_authenticator_pubkey — a compressed BabyJubJub public key encoded as a 0x-prefixed, zero-padded 32-byte hex string.
• new_authenticator_address — the Ethereum address associated with the new authenticator. Callers may pass the zero address for a proving-only authenticator.

Errors

• Returns WalletKitError::InvalidInput if the public key or address is invalid.
• Returns a network error if an indexer or gateway request fails.

pub async fn has_authenticator_pubkey( &self, authenticator_pubkey: String, ) -> Result<bool, WalletKitError>

Returns whether the holder’s account already contains an authenticator public key.

This performs a read-only indexer fetch and does not submit an account operation.

Arguments

• authenticator_pubkey — a compressed BabyJubJub public key encoded as a 0x-prefixed, zero-padded 32-byte hex string.

Errors

• Returns WalletKitError::InvalidInput if the public key is invalid.
• Returns a network error if the indexer request fails.

pub async fn get_authenticator_pubkeys( &self, ) -> Result<Vec<Option<String>>, WalletKitError>

Returns the account’s authenticator public keys, indexed by key-set slot.

Each entry is the compressed BabyJubJub public key at that slot encoded as a 0x-prefixed, zero-padded 32-byte hex string, or None for an empty slot. A key’s position in this list is the pubkey_id expected by Self::remove_authenticator.

This performs a read-only indexer fetch and does not submit an account operation.

Errors

• Returns a network error if the indexer request fails.
• Returns an error if a stored public key cannot be encoded.

pub async fn remove_authenticator( &self, authenticator_address: String, pubkey_id: u32, expected_authenticator_pubkey: String, ) -> Result<String, WalletKitError>

Removes an authenticator from the holder’s World ID account.

Arguments

• authenticator_address — the Ethereum address associated with the authenticator being removed. Callers must pass the zero address for a proving-only authenticator.
• pubkey_id — the stable key-set slot of the authenticator being removed.
• expected_authenticator_pubkey — the compressed BabyJubJub public key the caller intends to remove, encoded as a 0x-prefixed, zero-padded 32-byte hex string. The removal is refused if pubkey_id currently holds a different key, catching callers acting on a stale key-set view (see Self::get_authenticator_pubkeys). This check is best-effort: the signing flow re-reads the key set afterwards, so a concurrent change to the slot between the check and that read can still remove whichever key the slot holds at signing time. Callers that need an exact-target guarantee must serialize account operations across the account’s authenticators.

Errors

• Returns WalletKitError::InvalidInput if the address or public key is invalid, if pubkey_id is out of range, if the slot is empty, or if the slot holds a different key.
• Returns a network error if an indexer or gateway request fails.

pub async fn poll_status( &self, request_id: String, ) -> Result<GatewayRequestStatus, WalletKitError>

Polls the gateway once for the status of an account operation.

Errors

Returns a network error if the gateway request fails.

impl Authenticator

pub async fn init_with_defaults( seed: Vec<u8>, rpc_url: Option<String>, environment: &Environment, region: Option<Region>, artifacts: Arc<dyn WalletKitZkArtifactSource>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and with SDK defaults.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

See CoreAuthenticator::init for potential errors.

pub async fn init_with_ohttp_defaults( seed: Vec<u8>, rpc_url: Option<String>, environment: &Environment, region: Option<Region>, artifacts: Arc<dyn WalletKitZkArtifactSource>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed using SDK defaults routed through the OHTTP relay. Opt-in alternative to Authenticator::init_with_defaults.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

See CoreAuthenticator::init for potential errors.

pub async fn init( seed: Vec<u8>, config: &str, artifacts: Arc<dyn WalletKitZkArtifactSource>, store: Arc<CredentialStore>, ) -> Result<Self, WalletKitError>

Initializes a new Authenticator from a seed and config.

The user’s World ID must already be registered in the WorldIDRegistry, otherwise a WalletKitError::AccountDoesNotExist error will be returned.

Errors

Will error if the provided seed is not valid or if the config is not valid.

pub async fn generate_proof( &self, proof_request: &ProofRequest, now: Option<u64>, ) -> Result<ProofResponse, WalletKitError>

Generates a proof for the given proof request.

Errors

Returns an error if proof generation fails.

pub async fn prove_credential_sub( &self, nonce: &FieldElement, context: &FieldElement, blinding_factor: &FieldElement, sub: &FieldElement, ) -> Result<OwnershipProof, WalletKitError>

Generates a WIP-103 Ownership Proof for Issuers.

An Ownership Proof lets the user prove they own the credential sub associated with a stored credential without revealing their leaf_index.

Security-critical usage constraint

This method MUST only be called as part of a direct user-initiated action in the client. Callers MUST NOT expose this method to issuer-triggered, backend-triggered, or unauthenticated request flows.

Arguments

• nonce - A field element provided by the Issuer to prevent replay.
• context - A field element identifying the issuer operation being authorized.
• blinding_factor - The credential blinding factor previously used to derive the credential sub.
• sub - The credential sub (commitment) to prove ownership of.

Errors

• Returns WalletKitError::InvalidInput if blinding_factor and sub are inconsistent with each other (i.e. sub was not derived from this authenticator’s leaf index and the provided blinding factor).
• Returns a network error if the Merkle inclusion proof cannot be fetched from the indexer.
• Returns WalletKitError::ProofGeneration if the ZK proof fails.

Trait Implementations

impl Debug for Authenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<UT> LiftRef<UT> for Authenticator

type LiftType = Arc<Authenticator>

impl<UT> LowerError<UT> for Authenticator

fn lower_error(obj: Self) -> RustBuffer

Lower this value for scaffolding function return

impl<UT> LowerReturn<UT> for Authenticator

type ReturnType = <Arc<Authenticator> as LowerReturn<UniFfiTag>>::ReturnType

The type that should be returned by scaffolding functions for this type.

fn lower_return(obj: Self) -> Result<Self::ReturnType, RustCallError>

Lower the return value from an scaffolding call

fn handle_failed_lift( error: LiftArgsError, ) -> Result<Self::ReturnType, RustCallError>

Lower the return value for failed argument lifts

impl<UT> TypeId<UT> for Authenticator

const TYPE_ID_META: MetadataBuffer