@atproto/identity
TypeScript library for decentralized identities in atproto using DIDs and handles
Example
Resolving a Handle and verifying against DID document:
const didres = new DidResolver({})
const hdlres = new HandleResolver({})
const handle = 'atproto.com'
const did = await hdlres.resolve(handle)
if (did == undefined) {
throw new Error('expected handle to resolve')
}
console.log(did) // did:plc:ewvi7nxzyoun6zhxrhs64oiz
const doc = await didres.resolve(did)
console.log(doc)
// additional resolutions of same DID will be cached for some time, unless forceRefresh flag is used
const doc2 = await didres.resolve(did, true)
// helper methods use the same cache
const data = await didres.resolveAtprotoData(did)
if (data.handle != handle) {
throw new Error('invalid handle (did not match DID document)')
}
SSRF protection
HTTP identity resolution — the handle /.well-known/atproto-did endpoint,
did:plc, and did:web — is routed through an SSRF-protected fetch by
default. Private IPs, IP-literal hosts, http: URLs, custom ports, and a
handful of forbidden domain names are refused.
To resolve identities against localhost or another private network — a test
suite or a local dev stack — pass your own fetch. A supplied fetch is
used as-is and is never re-wrapped:
const didres = new IdResolver({ plcUrl, fetch: globalThis.fetch })
License
This project is dual-licensed under MIT and Apache 2.0 terms:
- MIT license (LICENSE-MIT.txt or http://opensource.org/licenses/MIT)
- Apache License, Version 2.0, (LICENSE-APACHE.txt or http://www.apache.org/licenses/LICENSE-2.0)
Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.