> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity-anchored login

> Reference application for apps that sign users in against their Sumvin Sigil — Proof of Personhood.

Identity-anchored login is a pattern where your app signs a user in against their <Tooltip headline="Sigil" tip="Sumvin's portable, KYC-verified identity — Proof of Personhood." cta="Glossary →" href="/glossary">Sigil</Tooltip> — inheriting their KYC-verified state and any attestation claims (age, Proof of Personhood) rather than re-verifying in your own silo.

<Snippet file="product-term-disambiguation.mdx" />

A Sigil is portable, KYC-verified identity a user carries across products. On the wire it is the `SRI` identity system — identifiers, scopes, and verification. The `proof_of_personhood` scope is the Sigil signal: when a user signs it, they're asserting a verified Sigil to your app.

## What the flow looks like

1. Your app prompts the user to sign a **Stamped Mandate (PINT)** carrying an identity scope — for example `sr:us:pint:identity:proof_of_personhood` or a KYC attestation scope.
2. Your app exchanges the signed Stamped Mandate with SIS for a JWT.
3. The JWT travels to your login endpoint as `x-sumvin-pint-token`.
4. Your backend verifies the JWT against the SIS JWKS, reads the `sub` claim (the user's SRI), and inherits the verified attestations from the token body.
5. You associate the Sumvin SRI with your local account record and issue your own session token.

## Which primitives back it

* **SRIs** are the durable, URI-style identifier behind a Sigil (for example `sr:us:person:safe:0x...`). See the [SRI format](/identity/sri).
* **JWT verification** is the same primitive as for checkout — verify against SIS JWKS, check `aud` and `exp`. See [Verify a JWT](/merchant/verify-jwt).
* **Attestation claims** carry verified facts — age, KYC status, Proof of Personhood — inside the JWT body. See [attestation claims](/identity/attestation-claims).
* **Identity scopes** describe which verified facts the user is consenting to share, including the `proof_of_personhood` scope. See the [scopes reference](/identity/scopes).

## Where to start

Start with the [identity overview](/identity/overview) for how Stamped Mandates and JWTs work end-to-end, then the [SRI format](/identity/sri) for the identifier you'll bind to your local user record. When you're ready to accept incoming credentials, [verify a JWT](/merchant/verify-jwt) covers the validation path, and the [scopes reference](/identity/scopes) helps you pick the right identity scope. **A Sigil is a verified person, portable across every app that accepts it — sign them in once, trust the attestation everywhere.**

## Related

* [Attestation claims](/identity/attestation-claims)
* [JWKS endpoint](/merchant/jwks)
* [Verifier overview](/merchant/overview)