SSO

World
API integration

Ship SSO features without building the integration. Full World API access via Proxy and 30+ MCP-ready tools for AI agents — extend models and mappings to fit your product.

Talk to us

Use Cases

Why integrate with World

Common scenarios for SaaS companies building World integrations for their customers.

Add Proof-of-Personhood to Customer Onboarding

CIAM and identity SaaS platforms can offer World ID as a 'verified human' signal alongside traditional SSO. Their customers instantly reduce fake signups, multi-accounting, and bot-driven fraud without collecting additional PII.

Bot-Proof Promotions and Ticketing

E-commerce, loyalty, and ticketing SaaS platforms can gate coupon redemptions, drops, and checkout flows behind World ID verification. The nullifier hash guarantees one-human-one-claim, even across proxies and disposable emails.

Sybil-Resistant Governance and Polling

Voting, governance, and community SaaS products can offer 'one human, one vote' as a native option. Communities get provably fair outcomes without weighting by token holdings or relying on brittle email verification.

MiniKit-Powered Re-Engagement for Web3 SaaS

Marketing automation and CRM platforms serving World App builders can trigger push notifications and orchestrate campaigns timed to users' WLD grant cycles, reaching them precisely when liquidity and intent are highest.

Identity-Linked Credit and Wallet Workflows for Fintech

Fintech and DeFi SaaS platforms can pull World ID credit scores and manage on-chain recovery agents for their end users, unlocking undercollateralized lending and enterprise-grade account recovery without building the primitives in-house.

What You Can Build

Ship these features with Truto + World

Concrete product features your team can ship faster by leveraging Truto’s World integration instead of building from scratch.

Incognito Action Verification Flow

Ship a drop-in 'Verify with World ID' step that calls create_a_world_verify and stores the nullifier_hash to enforce one-time actions like coupon claims, votes, or airdrop redemptions.

MiniKit Push Notification Campaigns

Trigger targeted notifications to World App users via create_a_world_minikit_send_notification, orchestrated inside your existing campaign builder.

Grant-Cycle Timed Engagement

Query list_all_world_minikit_user_grant_cycles to schedule marketing, offers, or transactions around each user's nextGrantClaimUTCDate for maximum conversion.

On-Chain Transaction Reconciliation

Use get_single_world_minikit_transaction_by_id and get_single_world_minikit_userop_by_id to confirm settlement status of in-app payments and user operations inside your billing or order systems.

Account Recovery and Authenticator Management

Expose flows for adding, updating, and removing authenticators plus initiating, executing, or cancelling recovery agent updates — all without your team writing on-chain logic.

World ID Credit Score Lookups

Pull a user's World credit state and score via get_single_world_credit_by_id to power lending decisions, tiered access, or risk-based UX in your fintech product.

SuperAI

World AI agent tools

Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.

create_a_world_verify

Verify a World ID proof for a Cloud action in World. Returns: success, action, nullifier_hash, created_at. Required: verify_id.

world_verifies_create_legacy

Verify a World ID proof for a Cloud action using the legacy v2 verify endpoint in World. Returns: success, action, nullifier_hash, created_at. Required: verify_id.

list_all_world_verifies

List World ID verifications in World. Returns records with: success, action, nullifier, created_at, environment, session_id, results, message.

create_a_world_minikit_send_notification

Send notifications to users of your World mini app by wallet address. Returns per-recipient results with walletAddress, sent, and reason. Required: app_id, wallet_addresses, mini_app_path. Either title and message (legacy) or localisations (localized) must also be provided; if both are given, localisations is used. Max 1000 wallet addresses per call.

get_single_world_minikit_transaction_by_id

Get a World MiniKit transaction by id to query its current on-chain status. Returns the transaction object including reference, transaction_hash, transaction_status, from, to, token_amount, token, chain, timestamp, and app_id. Required: id, app_id.

get_single_world_minikit_userop_by_id

Get a single MiniKit user operation in World by id and resolve the final on-chain transaction hash when it becomes available. Returns: status, userOpHash, sender, transaction_hash, nonce. Required: id.

list_all_world_transaction_debugs

Debug transactions that failed during the prepare stage in World. Returns a list of debug entries with debugUrl, createdAt, block, simulationRequestId, simulationError, and walletAddress. Required: app_id.

list_all_world_miniapps_prices

Get latest token prices in various fiat currencies from World. Returns: prices. Required: fiatCurrencies, cryptoCurrencies.

list_all_world_minikit_user_grant_cycles

Get the next grant claim cycle date for a user of your World mini app. Returns the user's humanity (orb-verified) grant cycle date if available, otherwise falls back to their document (passport-verified) grant cycle date. Returns: nextGrantClaimUTCDate. Required: wallet_address, app_id. The wallet_address must be exactly 42 characters long.

create_a_world_create_action

Create an incognito action for an app in World. Returns the created action object with its id and content-type-specific attributes. Required: create_action_id.

create_a_world_precheck

Fetch action metadata for a World ID app to determine a user's eligibility for verification. Returns: id, is_staging, is_verified, name, verified_app_logo, engine, __typename, sign_in_with_world_id, can_user_verify, action. Required: precheck_id, action.

list_all_world_jwks

List JWK public keys used to verify World JWT signatures for verification requests. Returns: kid, kty, e, n.

create_a_world_graphql

Execute GraphQL queries and mutations against the World Developer Portal via the GraphQL proxy. Returns: data (query results whose shape depends on the operation), errors (array of GraphQL error objects if any occurred). Required: query.

update_a_world_cancel_recovery_agent_update_by_id

Cancel a pending recovery agent update in the World ID gateway. Returns: request_id, kind, status. Requires a JSON request body conforming to the CancelRecoveryAgentUpdateRequest schema.

create_a_world_create_account

Create a new World ID account via the World registry gateway. Returns a 202 gateway status response including request_id, kind, and status for tracking the async on-chain request. Required: recovery_address, authenticator_addresses, authenticator_pubkeys, offchain_signer_commitment. Numeric string fields accept decimal or 0x/0X-prefixed hex.

update_a_world_execute_recovery_agent_update_by_id

Execute a pending recovery agent update for a World ID account in the World gateway. Returns: request_id, kind, status (with state and optional tx_hash). Required: leaf_index, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. Returns 400 if leaf_index is zero or no pending update exists.

list_all_world_healths

Check the health status of the World gateway server. Returns a general server status check response indicating server availability.

update_a_world_initiate_recovery_agent_update_by_id

Initiate a recovery agent update for a World ID account through the World gateway. Returns a gateway status object including request_id, kind, and status for polling the on-chain request. A JSON request body (UpdateRecoveryAgentRequest) is required.

create_a_world_insert_authenticator

Insert a new authenticator for a World account via the registry gateway. Returns a 202 status response with request_id, kind, and status. Required: leaf_index, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce, pubkey_id, new_authenticator_pubkey. Numeric string fields accept decimal or 0x-prefixed hex.

list_all_world_is_valid_roots

Check whether a given merkle root is currently valid on-chain in World. Returns: valid. Required: root.

create_a_world_recover_account

Recover a World account by submitting a recovery request to the registry gateway. Returns: request_id, kind, status. Required: leaf_index, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. The request is processed asynchronously and returns 202 Accepted.

create_a_world_remove_authenticator

Remove an authenticator from a World ID account via the World gateway. Returns: request_id, kind, status. Required: leaf_index, authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce. Numeric string fields accept decimal or 0x/0X-prefixed hex; returns 202 Accepted with a request_id for polling status.

get_single_world_status_by_id

Get the status of a World registry gateway request by id. Returns the request_id, kind (the operation type), and status (current state with optional tx_hash and error details). Required: id.

create_a_world_update_authenticator

Update an authenticator in the World ID registry gateway. Returns: request_id, kind, status. Required: leaf_index, old_authenticator_address, new_authenticator_address, old_offchain_signer_commitment, new_offchain_signer_commitment, signature, nonce, pubkey_id, new_authenticator_pubkey. Numeric string fields accept decimal or 0x-prefixed hex. Response is asynchronous (HTTP 202) — poll request_id…

create_a_world_authenticator_pubkey

Get the compressed authenticator public keys for a World ID account by leaf index from the World ID Indexer. Returns: authenticator_pubkeys, offchain_signer_commitment. Required: leaf_index.

create_a_world_inclusion_proof

Get a Merkle inclusion proof for a World ID account by leaf index from the current WorldIDRegistry tree, including the full authenticator public key slot list with null entries for removed authenticators. Returns: authenticator_pubkeys, leaf_index, root, siblings. Required: leaf_index.

create_a_world_packed_account

Get packed account data for a given authenticator address from the WorldIDRegistry contract in World. Returns: packed_account_data. Required: authenticator_address.

create_a_world_pending_recovery_agent

Get the pending recovery agent update for a particular World ID given its leaf index in World. Returns: execute_after, pending_recovery_agent, recovery_agent_address. If no recovery agent update is pending, the zero address and zero execute-after timestamp are returned. Required: leaf_index.

create_a_world_recovery_agent

Get the recovery agent address for a particular World ID given its leaf index from the World ID Indexer. Returns: recovery_agent. Required: leaf_index.

create_a_world_signature_nonce

Get the current signature nonce for a World ID by its leaf index from the World ID Indexer. The nonce is used to perform on-chain operations for the World ID. Returns: signature_nonce. Required: leaf_index.

get_single_world_credit_by_id

Get credit data for a World borrower by id (wallet address or World username). Returns: state, score. Required: id.

Why Truto

Why use Truto’s MCP server for World

Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 650+ integrations.

Auto-generated, always up to date

Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.

Fine-grained access control

Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.

Multi-tenant by design

Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.

Works with every MCP client

Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.

Built-in auth, rate limits, and error handling

Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.

Expiring and auditable servers

Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.

How It Works

From zero to integrated

Go live with World in under an hour. No boilerplate, no maintenance burden.

Link your customer’s World account

Use Truto’s frontend SDK to connect your customer’s World account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.

We handle authentication

Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.

Call our API, we call World

Truto’s Proxy API is a 1-to-1 mapping of the World API. You call us, we call World, and pass the response back in the same cycle.

Unified response format

Every response follows a single format across all integrations. We translate World’s pagination into unified cursor-based pagination. Data is always in the result attribute.

FAQs

Common questions about World on Truto

Authentication, rate limits, data freshness, and everything else you need to know before you integrate.

How do end users connect their World account through our product?

Truto handles the connection flow so your users authenticate with World ID (via QR code or deep link into the World App) and grant your application access. You receive a connection you can use to call any of the supported World endpoints on their behalf.

Which World workflows are supported today?

Truto supports World ID verification (create_a_world_verify, legacy verify, list verifies), MiniKit operations (send notifications, look up transactions and user operations, list prices and grant cycles), identity primitives (JWKs, inclusion proofs, signature nonces, authenticator management, packed accounts), account recovery flows (initiate/execute/cancel recovery agent updates, recover account, create account), credit lookups, and health/status/GraphQL utilities.

How does nullifier-based deduplication work in practice?

When you call create_a_world_verify for a specific action, World returns a nullifier_hash unique to that user-action pair. You store the hash on your side; if the same human tries the action again, the identical hash is returned and you can reject the duplicate — no PII involved.

Can we manage authenticators and recovery agents for our end users?

Yes. Truto exposes create_a_world_insert_authenticator, create_a_world_update_authenticator, create_a_world_remove_authenticator, create_a_world_authenticator_pubkey, plus the full recovery agent lifecycle (pending, initiate, execute, cancel) so you can build enterprise-grade identity management flows.

How do we verify that a MiniKit in-app transaction actually settled?

Use get_single_world_minikit_transaction_by_id (or get_single_world_minikit_userop_by_id for user operations) to fetch the current status, transaction hash, and chain metadata. Poll or trigger on your webhook pipeline to reconcile with your internal ledger.

Are there Unified APIs for World, or is this a direct integration?

World is currently exposed as a direct integration through Truto's tool inventory rather than mapped into a Unified API. You get one consistent auth, request, and error-handling layer via Truto, while calls map 1:1 to World's native endpoints so no capabilities are abstracted away.

World

Get World integrated into your app

Our team understands what it takes to make a World integration successful. A short, crisp 30 minute call with folks who understand the problem.