zkLogin

zkLogin is a Sui primitive that lets users send transactions from a Sui address using an OAuth credential (Google, Apple, Facebook, and others) without publicly linking the two. Users sign in with a provider they already use, and the application derives a Sui address from that credential. No seed phrases, no persistent private keys.

Why zkLogin

• Familiar onboarding: Users transact on Sui through the OAuth login flow they already know. No mnemonics, no key management.
• Self-custody: A zkLogin transaction requires the user to approve through OAuth. The OAuth provider cannot transact on the user's behalf.
• Two-factor security: Signing a transaction requires both a recent OAuth credential and a per-user salt. Compromising one factor alone is not enough to move funds.
• Privacy by default: Zero-knowledge proofs prevent third parties from linking a Sui address to its OAuth identity.
• Native to Sui: zkLogin is a protocol-level primitive, not a third-party service. It composes with multisig, sponsored transactions, and other Sui features.
• Audited and verified: The zkLogin circuits have been audited by two firms specializing in zero-knowledge proofs. The trusted setup ceremony included more than 100 participants.

How zkLogin works

At a high level, the zkLogin flow has four phases:

1. Ephemeral key pair + OAuth login

Your application generates a short-lived key pair and embeds its public key in the OAuth nonce. The user signs in with their OAuth provider, which returns a JWT containing that nonce.

2. ZK proof generation

A proving service takes the JWT, the ephemeral public key, a per-user salt, and the max epoch, and produces a zero-knowledge proof. This proof attests that the user holds a valid OAuth credential for a specific address, without revealing the JWT onchain.

3. Address derivation

The user's Sui address derives deterministically from sub (the provider's user identifier), iss (the provider), aud (the application's client ID), and user_salt. The same inputs always produce the same address. See Address definition for the full formula.

4. Transaction signing and submission

The ephemeral private key signs the transaction. The signature is combined with the ZK proof into a composite zkLogin signature, which validators verify before executing the transaction.

For the detailed step-by-step protocol, see How zkLogin works.

Supported providers

The following table lists the OpenID providers that can support zkLogin or are currently being reviewed to determine whether they can support zkLogin.

Provider	Can support?	Devnet	Testnet	Mainnet
Facebook	Yes	Yes	Yes	Yes
Google	Yes	Yes	Yes	Yes
Twitch	Yes	Yes	Yes	Yes
Apple	Yes	Yes	Yes	Yes
Slack	Yes	Yes	No	No
Kakao	Yes	Yes	No	No
Microsoft	Yes	Yes	No	No
AWS (Tenant)*	Yes	Yes	Yes	Yes
Karrier One	Yes	Yes	Yes	Yes
Credenza3	Yes	Yes	Yes	Yes
RedBull	Under review	No	No	No
Amazon	Under review	No	No	No
WeChat	Under review	No	No	No
Auth0	Under review	No	No	No
Okta	Under review	No	No	No

• Sui supports AWS (Tenant) but the provider is enabled per tenant. Contact us for more information.

Common questions

Can my app retrieve a user's email from a zkLogin address?

No. A zkLogin address is derived from sub, iss, aud, and user_salt. It exposes no identifying information. You cannot recover an email from an address, a zero-knowledge proof, or onchain data. If you need the email, read it from the JWT claims during the OAuth login flow (request the email scope) and store it in your application.

Does the zkLogin address change or expire?

The address is stable as long as the inputs remain the same: same OAuth identity (sub, iss), same application (aud), and same user_salt. The address does not expire.

What does expire is the ephemeral key pair. The maxEpoch parameter controls how long a single session can authorize transactions. When the session expires, the user logs in again, generates a new ephemeral key pair and ZK proof, and continues using the same address.

If the user signs in with a different OAuth provider or a different application, they get a different address because iss and aud differ.

What happens if the salt is lost?

The user permanently loses access to that zkLogin address. Even with a valid OAuth login, you cannot derive the address without the correct salt. Plan salt persistence, backup, and recovery accordingly. See Salt management in the integration guide.

Is a zkLogin wallet custodial?

No. A zkLogin wallet is non-custodial. It functions as a 2-of-2 scheme where the two credentials are the OAuth login and the salt. No third party (not the OAuth provider, the wallet vendor, the proving service, or the salt service) holds both factors.

How is zkLogin different from MPC or multisig wallets?

MPC and multisig wallets split or distribute private keys and define a threshold for signing. zkLogin does not split any keys. Instead, it registers a fresh ephemeral key through the OAuth nonce at each login. The advantage is that no persistent private key exists anywhere, not even in an MPC or multisig setup. You can also include a zkLogin signer inside a Sui multisig wallet for additional security.

Can I use zkLogin inside a multisig wallet?

Yes. See the Multisig guide.

When to use zkLogin

Scenario	Recommended approach
Consumer app with non-crypto users	zkLogin with Enoki for managed salt + sponsored transactions
App where users might or might not have a wallet	zkLogin as one connection option alongside traditional wallets through dApp Kit
App that needs full control over proving and salt	zkLogin self-hosted integration
Backend service or agent identity	zkLogin with a service-owned OAuth credential
Users who already have wallets	Traditional wallet connection through dApp Kit. zkLogin is optional.

Next steps

Integration Guide

Step-by-step implementation: ephemeral keys, JWT, salt, ZK proof, and signature assembly.

Configure OpenID Providers

Set up OAuth clients with Google, Facebook, Apple, Twitch, Kakao, Slack, or Microsoft.

zkLogin Demo

Interactive React example demonstrating the full zkLogin flow.

Technical Reference

Address derivation formula, ceremony details, security analysis, and protocol notations.

zkLogin Wallets

Wallet implementations including Enoki (managed service) and the Playtron wallet.