NFC Issuer

NFC issuer endpoints, including migration for World ID v3 NFC credentials.

The NFC issuer exposes endpoints for issuing and migrating NFC credentials. For product-level credential semantics, Sybil-resistance guarantees, and validity details, see NFC Credential.

The base URL is environment-specific. Contact your World ID point of contact for environment endpoints and access.

Migration

This endpoint is intended for World ID v3 holders to obtain v4 NFC credentials. It is not a general re-issuance endpoint for v4 holders.

method · POST

/v2/migrate

Content-Type: application/json

Request

Headers

Header	Required	Description
x-zkp-proof string	yes	Base64-encoded JSON containing the ZKP proof and identity commitment.
attestation-gateway-token string	yes	Attestation gateway token for device integrity verification.

Body fields

Field	Required	Description
identityCommitment string	yes	The holder’s identity commitment (decimal or hex with 0x prefix). Must match the ZKP header.
sub string	yes	World ID 4.0 blinded subject identifier (hex with 0x prefix, 256-bit). Must match previous migrations for this identity.
credential object	yes	Flow-specific credential data (see below). The client decrypts PCP data locally before submission.

Credential fields

Passport / eID

The credential object contains data extracted and decrypted from the user’s Personal Custody Package (PCP) by the client.

Field	Description
credential.sod string	Base64-encoded SOD (Security Object Document) in DER format from the identity document.
credential.verification_metadata string	Base64-encoded verification metadata from the original document check.

{
  "identityCommitment": "0x000000000000000000000000000000000000000000000000000000000000000c",
  "sub": "0x000000000000000000000000000000000000000000000000000000000000002a",
  "credential": {
    "sod": "<base64-sod-der>",
    "verification_metadata": "<base64-json>"
  }
}

MNC (My Number Card)

Field	Description
credential.sd_jwt string	SD-JWT (Selective Disclosure JWT) from the MNC verification flow.

{
  "identityCommitment": "0x000000000000000000000000000000000000000000000000000000000000000c",
  "sub": "0x000000000000000000000000000000000000000000000000000000000000002a",
  "credential": {
    "sd_jwt": "<sd-jwt-string>"
  }
}

Response

Success response

{
  "result": {
    "credential": "<base64-encoded World ID v4 credential>"
  }
}

Error responses

Status	Error	Description
400	invalid_data	Request payload is malformed or missing required fields.
400	sub_mismatch	sub does not match the one used in previous migrations for this identity.
400	document_expired	The identity document has expired and cannot be used for migration.
401	unauthorized	Authentication failed.
404	not_found	No matching enrollment record found for this credential.

Planned Endpoints

Enrollment Coming soon

Details coming soon.

Re-issuance Coming soon

Details coming soon.

Implementation Notes

This is advanced documentation about the internal workings of the NFC Credential and is not relevant for RP integration.

Associated Data

The associated data of this credential contains different data groups found in the original document. More information coming soon.

Associated Data Commitment

To ensure the associated data has guaranteed integrity and can be re-used in the future for credential re-issuance, the commitment is computed as follows:

1. For ICAO-9303 documents, the message digest of the EF.SOD signature is used. The message digest is obtained from SignedData.SignerInfos[0].SignedAttrs where the signed attribute for the digest is identified by the Object Identifier 1.2.840.113549.1.9.4. This digest is then hashed with the blake3 hashing function from the raw bytes. Finally, the blake3 hash is converted to a field element with modulo reduction.
2. Information on MNC documents coming soon.