Skip to main content
Identity-anchored login is a pattern where your app signs a user in against their — inheriting their KYC-verified state and any attestation claims (age, Proof of Personhood) rather than re-verifying in your own silo. A Sigil is portable, KYC-verified identity a user carries across products. On the wire it is the SRI identity system — identifiers, scopes, and verification. The proof_of_personhood scope is the Sigil signal: when a user signs it, they’re asserting a verified Sigil to your app.

​
What the flow looks like

  1. Your app prompts the user to sign a Stamped Mandate (PINT) carrying an identity scope — for example sr:us:pint:identity:proof_of_personhood or a KYC attestation scope.
  2. Your app exchanges the signed Stamped Mandate with SIS for a JWT.
  3. The JWT travels to your login endpoint as x-sumvin-pint-token.
  4. Your backend verifies the JWT against the SIS JWKS, reads the sub claim (the user’s SRI), and inherits the verified attestations from the token body.
  5. You associate the Sumvin SRI with your local account record and issue your own session token.

​
Which primitives back it

  • SRIs are the durable, URI-style identifier behind a Sigil (for example sr:us:person:safe:0x...). See the SRI format.
  • JWT verification is the same primitive as for checkout — verify against SIS JWKS, check aud and exp. See Verify a JWT.
  • Attestation claims carry verified facts — age, KYC status, Proof of Personhood — inside the JWT body. See attestation claims.
  • Identity scopes describe which verified facts the user is consenting to share, including the proof_of_personhood scope. See the scopes reference.

​
Where to start

Start with the identity overview for how Stamped Mandates and JWTs work end-to-end, then the SRI format for the identifier you’ll bind to your local user record. When you’re ready to accept incoming credentials, verify a JWT covers the validation path, and the scopes reference helps you pick the right identity scope. A Sigil is a verified person, portable across every app that accepts it — sign them in once, trust the attestation everywhere.