ATProto in Practice #1: Identity
11 hours ago
- ATProto accounts have two identifiers: immutable DIDs and changeable human-readable handles.
- Handles are domain names, and existing domains can be used as handles.
- Resolving a handle to a DID requires checking both DNS TXT records and .well-known HTTP files.
- DID documents contain 'alsoKnownAs' with handles and 'service' with PDS endpoint.
- Verification is bi-directional: both directions should be checked to confirm ownership.
- Reserved TLDs like .alt, .local, .example should be rejected for handles.
- DIDs come in two main methods: did:plc (centralized, with history) and did:web (self-hosted, no history).
- did:plc stores full history of changes, viewable as audit logs.
- did:web is bound to a domain and cannot be moved; permanently available if domain is kept.
- Resolving did:plc goes to plc.directory, while did:web uses .well-known/did.json on the domain.
- DIDKit is a Ruby gem that simplifies handle and DID resolution.
- PLC export API allows bulk download of operations for large-scale data needs.
- Operation logs use different JSON format than DID documents; include tombstones and legacy formats.
- Filter out invalid handles from alsoKnownAs and verify them by resolving back.
- Not all handles may be real; validate and handle edge cases like multiple handles.