If you're hosting a PDS on Railway, uh, remember to update the rotation keys in your PLC records *before* changing the rotation key env var.
hailey
the pwning continues blog.railway.com/p/security-disclosure-wednesd…
Oct 21, 2026 at 11:00 PM
How to edit `did:plc` rotation keys · bluesky-social atproto · Discussion #3366
I have migrated my Bluesky handle rekmarks.com to my own PDS. I am trying to replace one of its rotation keys. Here's what I observe: I check the rotation keys returned by com.atproto.identity....
What the hell is a rotation key? - Hitchhiker's Guide to the Atmosphere
Why it's important that YOU should have a rotation key and backups for your Bluesky/AT Protocol account that is hosted on a third party PDS
What the hell is a rotation key? - HItchhikers Guide to the atmosphere
Why it's important that YOU should have a rotation key and backups for your Bluesky/AT Protocol account that is hosted on a third party PDS
plc-passkey · Passkeys as PLC Rotation Keys
Derive deterministic secp256k1 rotation keys from passkeys via WebAuthn PRF and add them to AT Protocol did:plc documents.
did:plc Specification v0.1
DID PLC is a self-authenticating DID which is strongly-consistent, recoverable, and allows for key rotation.
Taking control of your atproto account | jola.dev
Setting a rotation key on your atproto (Bluesky, Eurosky, etc) account means you can recover it even if the account provider shuts down.
socialdept/plc-mint
Grind vanity did:plc identifiers on your CPU or Apple GPU, then claim them as a new account on any AT Protocol PDS.
Sneak peek of a new Rotation Key editor I'm playing around with for pdsmoover.com
built an atproto terminal ui for setting up alternative plc rotation keys. there are two types of keys. hardware-based: no sync software-based: synced via icloud is anyone interested in this? I could package it up and release it, though it needs a lot of UX work. tangled.org/saewitz.com/plc-touch/
Ok, this will sound a little crazy, but if I'm managing my keys, what would happen if I turned my browser into my PDS? Like, I only use my PDS when im logged in, everything else gets mirrored by relays ... What would happen if my PDS was running locally as my browser?
Sam Goto
I made a decision on this: I'm going to keep using did:plc. There are many technical pros/cons, but I'm going to take a bet on people and use this product as the people designing it are using it too. Here is to changing ones mind!
Set up rotation keys for my atproto accounts and wrote about the experience jola.dev/posts/taking-control-atproto-…
Taking control of your atproto account | jola.dev
jola.devcreated a plc backed by sqlite instead of postgres if anyone is interested tangled.org/chadtmiller.com/plc-sqlite i have a setup for an appview in railway where i create an ephemeral environment per pr against a long running pds and plc with some test accounts for dev.
Another day, another odd edge case migration thing to troubleshoot. Looks like the entryway updates the user's PLC did doc if on a Bluesky PDS, and it does this by a serviceAuth token. If you migrated back, but did not update your verification method when you moved, you can lock yourself out..
Ok, this will sound a little crazy, but if I'm managing my keys, what would happen if I turned my browser into my PDS? Like, I only use my PDS when im logged in, everything else gets mirrored by relays ... What would happen if my PDS was running locally as my browser?
Sam Goto
I made a decision on this: I'm going to keep using did:plc. There are many technical pros/cons, but I'm going to take a bet on people and use this product as the people designing it are using it too. Here is to changing ones mind!
