ATProto gives your PDS operator full control of your signing and rotation keys, letting them impersonate you across every app in the ecosystem or kill
Your identity isn't your username
Your handle is a label; your identity is a key you own. atproto splits who you are from what you're called, so you can rename freely, prove who you are with a domain you control, and carry one identity across the apps you use. Part of 'Apps as Views, Not Vaults': the things you make are yours; apps are just the viewers.
I Was Right About ATProto Key Management - nora's notes
Note: this post has been revised to be split into two sections: a description of what happened, and my analysis. I hope to make it clear that, while I do not like ATProto in general, I am trying to make good-faith critcisms of specific design decisions and outcomes, and in fact, this post getting updoots on HackerNews appears to have gotten the attention of the team, so, mission accomplished. ref, ref My account has since been manually reinstated; this has not happened for any of the other users that have had this issue, as far as I know.
Registering Identity Recovery Keys via PDS, using goat | bryan newbold
One of the big design goals for atproto is for users to "own their network identity". If something goes wrong with a hosting provider, it should be possible recover accounts by independently updating their identity to point at a new home. Every account in the network has both a handle and a DID. Th...
@me - explore your atproto identity
visualize your decentralized identity and see what apps have stored data in your Personal Data Server
@me - explore your atproto identity
visualize your decentralized identity and see what apps have stored data in your Personal Data Server
@me - explore your atproto identity
see your atmosphere account — one account, all your apps and data
your app can run its own pds - keith.is
if you’re building on atproto, you’ve probably reached for “sign in with bluesky” as your auth story. it works! the OAuth flow is fine. but every time a user shows up without a bluesky account, you have to send them to bluesky first, watch them get confused by a totally different brand, and hope they come back. that’s a weird seam in your own product.
ATProto User Intents Demo
This is a demo tool which allows atproto accounts to configure a reuse declaration for their public data. You can read more about this atproo mechanism in the "User Intents for Data Reuse" proposal from March 2025. Any account in the atproto network (including Bluesky accounts) can use this tool via OAuth. The source code for this demo is linked above.
the single most important part of atproto is the PDS as a user-controlled auth and storage layer to which clients can connect directly. death to appviews
Authenticated Transfer Enables Orchestration - nekomimi
blog.nekomimi.petthis is kinda another reason im starting to think more and more that there would be worth in splitting atprotos identity layer out as its own spec and standard. building up handles and oauth around a DID makes for a really flexible cross platform (and potentially cross ecosystem) identity system
Nelind
i kinda hate how atproto adopting DIDs has made people intrinsically associate DIDs with atproto ... it makes some people see me as some annoying bitch trying to shove atproto into places it obviously doesnt belong in when i suggest using DIDs as user identifiers for other systems
if you’re using Bluesky OAuth in your app, change your metadata filepath to /oauth-client-metadata.json to have just your brand domain show up on the authorize screen rather than a suspicious looking url string i think 90% of atproto apps don’t do this, seems to not be documented yet
ollie thanks mozz 🫶
(sorry for driveby but i think tangled can update the file to be at path `/oauth-client-metadata.json` to get rid of that long display name *disappears*)
