Zero-Click Authentication for Apps

Clicking 'Run' on a Replit cover page creates a guest fork. For security, this environment is isolated so it cannot access the user's secrets or the Repl Database, which has limited the ability to implement social features like high score records or chat.

To solve this, Repl Identity has been introduced. Now every repl is provided with the REPL_IDENTITY environment variable, a PASETO token signed by Replit infrastructure. Through this token, developers can verify users without requiring them to press a separate button or enter a password.

This can be used to implement various social features such as high score tables, chat, and multiplayer games. Since the server can trust the user via the token, it can safely perform tasks like saving game state or calling APIs.

While the existing Repl Auth handles browser-based web authentication, Repl Identity is designed for projects where web authentication is difficult to apply, such as terminal or VNC environments.

Technically, it requires a PASETO implementation and Protocol Buffers (protobuf) parsing. The token follows a trust chain leading from root, to intermediate, to leaf, and the signature can be verified through the ED25519 public key included in the REPL_PUBKEYS environment variable.