Google: Returns a signed JWT (id_token) containing your email, user ID, and verification status. The JWT is validated by the server using Google’s public keys. RSA JWT verification inside a ZK circuit would require ~200K constraints — so we verify it off-chain (same tradeoff as Sui zkLogin).
Passkey: Creates a WebAuthn credential bound to this origin. The credential ID becomes your identity anchor — no email, no OAuth, no PII. The tradeoff: a lost credential = a new identity (unlike Google, which can be recovered from any device).
Identity hash:
SHA-256("{provider}:{email}:{userId}:verified:{emailVerified}")
truncated to 31 bytes (248 bits) to fit the BN254 scalar field.
The circuit is identity-agnostic — it only sees a field element.