Wiring World ID into this app.

A unique identifier for your app. Anyone who inspects the page can see it — it's not a secret, it just tells the World App which project a proof is for.

A named event you're verifying a human for — one proof per user per action. Must match exactly on the widget and on the portal, or verification fails.

Each action has a verification level: Device (any World App user) or Orb (Orb-verified humans only). This project uses the World ID 4.0 docs default, orbLegacy(), because this app is configured as an Orb-backed external app.

World ID v4 replaces the old WalletConnect deep-link with a signed handshake. You register an RP in the portal, which gives you two things:

• rp_id — public identifier for the relying party.
• signing key — a hex-encoded private key. Never ships to the browser.

When the user taps Verify with World ID, the widget needs a short-lived signature proving this app is a registered RP for the given action. Here's the round-trip:

  browser                server                     Worldcoin
    │                      │                             │
    │  POST rp-signature   │                             │
    │─────────────────────▶│  signRequest(action, key)   │
    │  {rp_id, sig, nonce} │                             │
    │◀─────────────────────│                             │
    │                                                    │
    │  IDKit widget opens · World App scans QR · proof   │
    │                                                    │
    │  POST /api/…/verify  │                             │
    │─────────────────────▶│  POST v4/verify/{rp_id} ───▶│
    │      {verified}      │◀─────────── {verified} ─────│
    │◀─────────────────────│                             │

The signature expires after 5 minutes, so the widget fetches a fresh one each time it opens.

World ID v4 uses app_id and rp_id for different things. The current v4 verify API prefers the RP ID; the App ID is still accepted only for backward compatibility. They look similar, they're both public, they're not interchangeable.

• app_id — identifies the app in the widget's app_id prop and in the browser's request to this app's verify proxy.
• rp_id — used to sign the rp_context on the server and as the preferred ID in the upstream verify URL ( .../api/v4/verify/{rp_id}).

If this app verifies against a different ID than the signed RP context belongs to, World App can report success while the browser flashes red "Verification declined" a second later.

The client passes allow_legacy_proofs={true} alongside deviceLegacy(). Modern World ID 4.0 apps ship with legacy proofs implicitly enabled, so there's usually no toggle to flip.

Only revisit this if verify keeps returning invalid_proof despite the client flag being set — then check Settings → Advanced in the portal.

Both are stored in Lovable Cloud (Project Settings → Secrets):

• WORLDID_RP_ID — the public rp_id string from the portal.
• WORLDID_RP_SIGNING_KEY — the hex private key you generated when creating the RP.

Both are read server-side only, inside src/routes/api/public/idkit/rp-signature.ts. Never hardcode them in src/config/worldid.ts or any client-imported module.