Gully ID sign-in

Gully ID is the one sign-in across every Gully product: the GullyChain app, the faucet, the bridge, the explorer, Gully Pay, Gully RPC and Gully Studio. It is a standard OpenID Connect provider, so any OIDC library works. Users sign in with a passkey, a wallet (SIWE) or email. Every user gets a smart-account wallet on GullyChain, and your app can ask for that wallet, the user's .gully name and their on-chain reputation as claims.

#Quickstart

1. Sign in to the console (opens in a new tab) with your own Gully ID.
2. Create an app. Pick a public client for code that runs in the browser or a mobile app (authorization code with PKCE, no secret), or a confidential client for a server (a client secret, shown once). Redirect URIs must be https and match exactly; http is allowed only for localhost.
3. Add the button. Load https://gullyid.xyz/sdk.js, or use any OIDC library.
4. Read the claims from the id_token, or from /userinfo.

#Browser: the SDK

<script src="https://gullyid.xyz/sdk.js"></script>
<button id="gully">Sign in with Gully</button>
<script>
  const gully = GullyID.init({ clientId: "YOUR_CLIENT_ID", scope: "openid profile wallet gully_name reputation" });
  document.getElementById("gully").onclick = async () => {
    const session = await gully.signIn(); // popup, PKCE, state and nonce checked
    console.log(session.profile);         // { sub, name, wallet, gullyName, ... }
  };
</script>

signIn() opens a popup by default. signIn({ mode: "redirect" }) uses a full-page redirect (call gully.handleRedirect() on your callback page), and signIn({ mode: "passkey" }) tries a passkey prompt straight away. gully.signOut() ends the session.

#Any OIDC library (PKCE)

GET https://gullyid.xyz/oauth2/auth?response_type=code&client_id=YOUR_CLIENT_ID
    &redirect_uri=https://app.example.com/auth/callback&scope=openid%20profile%20wallet
    &state=RANDOM&nonce=RANDOM&code_challenge=S256(VERIFIER)&code_challenge_method=S256

POST https://gullyid.xyz/oauth2/token
    grant_type=authorization_code&code=...&redirect_uri=...&code_verifier=VERIFIER&client_id=YOUR_CLIENT_ID

Confidential clients authenticate the token request with HTTP Basic (client_id:client_secret).

#Scopes and claims

The reputation claim is built from on-chain state: the GullyVerified check, the .gully name, Gully Quests completions, XP and soulbound badges (see Quests). Users see every item on the consent screen, with the value that would be shared. Gully ID never gives an app a passkey or a way to move funds: the wallet claim is an address, not a key.

#Google and X sign-in

#Plans

Billing goes through Gully Pay (opens in a new tab). Going over a plan never locks your users out: you get a notice and time to upgrade.

#Buttons

Use the official buttons from the guide, or the CSS button: <link rel="stylesheet" href="https://gullyid.xyz/assets/sign-in-with-gully.css"> with <a class="gully-signin" href="...">Sign in with Gully</a>.