Sidetree REST API specification: identity.foundation/sidetree/api
CLM - New claim for sharing
nodeTypeId: nodeKSiOfvkjvS-H6MHfDUdg nodeInstanceId: 019d688f-89ff-7119-a0df-d07aa0f3340f publishedToGroups:
tassis/atfield-core
Framework-agnostic AT Protocol utilities for identity resolution and public record reads.
google/longfellow-zk
Implementation of the Google Zero-Knowledge library for Identity Protocols.
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.
Identity is the Platform
This is the talk I gave at Mindtrek in Tampere, Finland. Slides are available here: http://factoryjoe.com/blog/2009/10/01/identity-is-the-platform/
eLife Claim Trees — eLife Claim Trees
Panel-level claim graphs for reproducibility — eLife Claim Trees
Cache8063/atauth
AT Protocol (Bluesky) authentication library for Rust, TypeScript, and Node.js
Federated Credential Management (FedCM) API - Web APIs | MDN
The Federated Credential Management API (or FedCM API) provides a standard mechanism for identity providers (IdPs) to make identity federation services available on the web in a privacy-preserving way, without the need for third-party cookies and redirects. This includes a JavaScript API that enables the use of federated authentication for activities such as signing in or signing up on a website.
Just spent a bunch of time working on the Client ID Metadata Documents internet draft to make it possible to support multiple token endpoint authentication methods — github.com/oauth-wg/draft-ietf-oauth-cli…
Document token endpoint auth methods supported by ThisIsMissEm · Pull Request #99 · oauth-wg/draft-ietf-oauth-client-id-metadata-document
github.comthis is kinda another reason im starting to think more and more that there would be worth in splitting atprotos identity layer out as its own spec and standard. building up handles and oauth around a DID makes for a really flexible cross platform (and potentially cross ecosystem) identity system
Nelind
i kinda hate how atproto adopting DIDs has made people intrinsically associate DIDs with atproto ... it makes some people see me as some annoying bitch trying to shove atproto into places it obviously doesnt belong in when i suggest using DIDs as user identifiers for other systems
alright protocol devs, some wonky bits: we revisited the recent service auth JWT harmonization proposal, and have a revision up that sticks with a single string 'aud' field. also touches on issuer 'kid', and makes 'lxm' mandatory for XRPC endpoints.
proposals/0014-service-auth-revised at main · bluesky-social/proposals
github.comEmDash now supports Atmosphere login as a first-class identity provider. More details here: docs.emdashcms.com/guides/atmosphere-auth/
Atmosphere Login
docs.emdashcms.comI feel like the logical endpoint is ISPs giving you an atproto identity when you sign up, if you don’t already have one. Would that make things easier? Would we be okay with that, assuming nothing breaks and you can change your PDS afterward?
Ariel M. (she/her)
Changing your phone provider = changing your atmosphere provider → keep your phone number = keep your identity (username) Changing your phone = changing what app you use* → keep your contacts & photos = keep your followers, following, posts, etc. You can change providers without changing phones.
Heeey, look, it's me! I'm super hyped to announce that @bsky.app have given me a grant to work on the standards for the Federated Credential Management API (or FedCM) to make them really work for all decentralized web applications.
AT Protocol Developers
We're so excited to support @thisismissem.social's work bringing FedCM to the open social web! atproto.com/blog/working-to-decentralize-…
EmDash now supports Atmosphere login as a first-class identity provider. More details here: docs.emdashcms.com/guides/atmosphere-auth/
Atmosphere Login
docs.emdashcms.com
