Docs

Sign in with Gully

Gully ID is a standard OpenID Connect provider. Any OIDC library works; the browser SDK is a small wrapper for single-page apps.

Sign inOpen the console with your Gully ID (passkey, wallet or email). No waitlist.
Create an appPick public (browser, PKCE) or confidential (server), add your https redirect URIs.
Add the buttonLoad https://gullyid.xyz/sdk.js or use any OpenID Connect library.
Read the claimsGet the user's id, wallet, .gully name and reputation from the id_token.

1. Create an app

In the console, create a public client for code that runs in the browser or a mobile app (authorization code + PKCE, no secret), or a confidential client for a server (a client secret, shown once). Redirect URIs must be https and match exactly; http is allowed only for localhost.

2. Discovery

Issuerhttps://gullyid.xyz/

Discoveryhttps://gullyid.xyz/.well-known/openid-configuration

3a. Browser (SDK)

<script src="https://gullyid.xyz/sdk.js"></script>
<button id="gully">Sign in with Gully</button>
<script>
  const gully = GullyID.init({ clientId: 'YOUR_CLIENT_ID', scope: 'openid profile wallet gully_name reputation' })
  document.getElementById('gully').onclick = async () => {
    const session = await gully.signIn()      // popup, PKCE, state + nonce checked
    console.log(session.profile)              // { sub, name, wallet, gullyName, ... }
  }
</script>

3b. Any OIDC library (PKCE)

GET https://gullyid.xyz/oauth2/auth?response_type=code&client_id=YOUR_CLIENT_ID
    &redirect_uri=https://app.example.com/auth/callback&scope=openid%20profile%20wallet
    &state=RANDOM&nonce=RANDOM&code_challenge=S256(VERIFIER)&code_challenge_method=S256

POST https://gullyid.xyz/oauth2/token
  grant_type=authorization_code&code=...&redirect_uri=...&code_verifier=VERIFIER&client_id=YOUR_CLIENT_ID

Verify the id_token against https://gullyid.xyz/.well-known/jwks.json (iss, aud = your client_id, exp, nonce). Confidential clients authenticate the token request with HTTP Basic (client_id:client_secret).

4. Claims

Scope	Claims
`openid`	`sub` (stable per user), `amr` (passkey, wallet, email, google, x)
`profile`	`name`, `picture`
`email`	`email`, `email_verified`
`wallet`	`wallet: { chainId: 485590, address, kind }`
`gully_name`	`gully_name` (e.g. alice.gully) or null
`reputation`	`reputation: { verified, hasGullyName, accountAgeBlocks, quests: { completed, ids }, xp, badges, available }`
`offline_access`	a refresh token (30 days, rotated)

Buttons

Use the official buttons: dark, light, icon only. Or the CSS button: <link rel="stylesheet" href="https://gullyid.xyz/assets/sign-in-with-gully.css"> + <a class="gully-signin" href="...">Sign in with Gully</a>.

Rules

Your users always see a consent screen listing what is shared. Gully ID never gives an app a passkey or a way to move funds. Keep a confidential client's secret on your server only; rotate it in the console if it leaks.