zklogin

Authenticate users via OAuth to derive Sui addresses without private keys.

Updated Feb 12, 2026

Search Tags:#oauth #jwt #identity #jwks #sui #zklogin

Ready to run

npx skills add https://github.com/tonyoconnell/agent-ui --skill zklogin

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: zklogin
Source: https://github.com/tonyoconnell/agent-ui/tree/main/.claude/skills/zklogin
Command: npx skills add https://github.com/tonyoconnell/agent-ui --skill zklogin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

zkLogin enables users to authenticate using OAuth providers (Google, Apple, Facebook, etc.) to obtain a Sui address that the user controls, without installing a wallet.

Core Features & Use Cases

No-wallet sign-ins: Users sign in via OAuth and receive a Sui address tied to their identity.
Multi-provider support: Works with Google, Apple, Facebook, Twitch, and others as OAuth backends.
End-to-end flow: Start → bounce → mint, with nonce binding, JWT verification, and session management for secure onboarding.
Use Case: A dApp can allow users to sign in and auto-join governance groups, then transact using zk-derived addresses.

Quick Start

Frequently Asked Questions about zklogin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I let users sign in with OAuth to get a Sui address without installing a wallet?▼

OAuth sign-in via zkLogin derives a Sui address tied to a user identity without exposing private keys or requiring wallet installation. Users authenticate through standard providers and receive a controlled Sui address for onchain interactions.

Which OAuth providers can I use for Sui zkLogin authentication?▼

Sui zkLogin authentication supports multiple OAuth providers including Google, Apple, Facebook, and Twitch. Each provider serves as an OAuth backend to verify user identity and derive a corresponding Sui address.

How does JWT verification secure the Sui zkLogin sign-in flow?▼

JWT verification secures the zkLogin sign-in flow by validating provider-issued tokens and binding them with nonce protection. This ensures the OAuth identity maps correctly to the derived Sui address, preventing replay attacks during the bounce and mint process.

Can I bind persistent user sessions to a zkLogin address for dApp onboarding?▼

Session cookies bind the verified user identity to the zkLogin front-door, enabling persistent sign-in for dApp onboarding. This allows authenticated users to auto-join governance groups and transact using their zk-derived Sui addresses across sessions.

Does zkLogin require users to manage private keys to control a Sui address?▼

zkLogin does not require users to manage private keys to control a Sui address. The zk-proof mechanism derives the address directly from the OAuth identity, eliminating the need for wallet installations or private key exposure during authentication.