AT Protocol
ActiveThe AT Protocol (Authenticated Transfer Protocol) is a decentralized social networking protocol developed by Bluesky. It uses self-certifying data – every record is cryptographically signed and verifiable without trusting any server. Identity is based on DIDs (Decentralized Identifiers) anchored in the DID PLC directory. Bluesky (bsky.app) is the primary deployment with 30+ million users as of 2026.
In one line
AT Protocol (atproto.com, 2022) is the decentralized protocol powering Bluesky. Identity uses DIDs (Decentralized Identifiers) – did:plc for managed recovery or did:web for self-hosted. Data is stored in a repository (Merkle tree / CAR files) – every record is cryptographically signed and verifiable. Schemas are defined in Lexicon (JSON schema variant). The Personal Data Server (PDS) stores your data; the AppView aggregates feeds. You can migrate your identity and data between PDS hosts.
Quick Reference
| Field | Size | Description |
|---|---|---|
| DID | did:plc or did:web | Decentralized Identifier – your permanent identity, independent of any server. did:plc uses the PLC directory for key rotation and recovery. did:web uses a DNS-hosted document. |
| Handle | @user.bsky.social | Human-readable alias for your DID. Verified via DNS TXT record or /.well-known/atproto-did file. You can use your own domain as your handle. |
| Repository | Merkle tree / CAR | Your data is stored in a content-addressed Merkle tree. Exported as CAR (Content Addressable aRchive) files. Every commit is signed by your signing key. |
| Lexicon | JSON Schema variant | AT Protocol schema language. Defines record types (app.bsky.feed.post), queries (app.bsky.feed.getTimeline), and procedures. NSIDs (reverse-DNS namespace IDs) identify each type. |
| PDS | Personal Data Server | Stores your repository, handles key management, serves your records. You can self-host a PDS or use Bluesky PBC's managed PDS. Account migration between PDS hosts is supported. |
| AppView | Feed aggregator | Aggregates data from many repositories to serve feeds, search, and discovery. The Bluesky app is an AppView. Third-party AppViews can build custom feeds and applications. |
| Relay/Firehose | Event stream | Aggregates all repository commits from the network in real time and streams them as a WebSocket firehose. AppViews subscribe to the relay to index new content. |
| XRPC | HTTP API | AT Protocol's HTTP API layer. Queries: GET /xrpc/app.bsky.feed.getTimeline. Procedures: POST /xrpc/com.atproto.repo.createRecord. Based on Lexicon definitions. |
Key Characteristics
Self-certifying data
Every AT Protocol record is signed by the author's signing key. A record can be verified without trusting the server hosting it – the signature proves authenticity.
Account portability
Your DID is independent of your PDS. You can migrate your account (DID, handle, all records) from one PDS to another without losing your identity or followers.
Not E2E encrypted
AT Protocol records are public by default. All posts on the relay are plaintext. There is no end-to-end encryption in the base protocol. DMs use a separate encrypted messaging layer.
Algorithmic choice
Unlike Twitter/X where the algorithm is fixed, AT Protocol's feed generator architecture lets anyone build and publish custom feeds. Users choose which algorithms to subscribe to.
Message Format
// Create a post record (XRPC procedure)
POST /xrpc/com.atproto.repo.createRecord HTTP/1.1
Host: bsky.social
Authorization: Bearer <atproto-token>
Content-Type: application/json
{
"repo": "did:plc:abc123...",
"collection": "app.bsky.feed.post",
"record": {
"$type": "app.bsky.feed.post",
"text": "Hello from ATProto!",
"createdAt": "2026-07-24T10:00:00.000Z",
"langs": ["en"]
}
}// Response: created record URI and CID
{
"uri": "at://did:plc:abc123.../app.bsky.feed.post/3k7xyz",
"cid": "bafyreib7..."
}
// Record URI anatomy:
// at:// (AT Protocol URI scheme)
// did:plc:abc123... (repository owner DID)
// /app.bsky.feed.post (Lexicon collection NSID)
// /3k7xyz (record key, usually TID timestamp)
// DID document for identity resolution:
{
"did": "did:plc:abc123...",
"alsoKnownAs": ["at://alice.bsky.social"],
"verificationMethods": [{
"id": "#atproto",
"type": "Multikey",
"publicKeyMultibase": "z6Mk..."
}],
"services": [{
"id": "#atproto_pds",
"type": "AtprotoPersonalDataServer",
"serviceEndpoint": "https://bsky.social"
}]
}