FAQ asked by real readers

Does this need to exist? What does it do that nothing else does?

The question we get most, and a fair one. Much of the machinery already exists: AT Protocol gives identity, signed repositories and a firehose; badge.blue and Hypercerts give a shared way to sign records; Tangled has vouches. We folded onto that stack a day after launch rather than compete with it (see changes). What attest adds is narrow, and we think it is real:

1. Statements about the open web. Records on AT Protocol are mostly about other records and accounts. attest's records are about URLs, DOIs and file hashes: this article, this paper, this photograph. That is where most of what reaches us actually lives.
2. A key you hold, on every record. Your passkey signs a permission for a device key, and that key signs every record inline. The record carries your own signature, not only the server's, so it can be checked with your key alone.
3. Sign-in and attestations as a drop-in. One script tag gives a static site or a small project sign-up, votes, comments and vouches, with no accounts, passwords or database of its own. That is the reason it was built: every one of the founder's projects was re-implementing auth.
4. Scores relative to you. When scoring lands, every answer is "trusted by people you trust", computed from a starting key you choose, never a platform number called "trustworthy".

Could it just not exist? Yes, if Bluesky, Tangled or the Hypercerts community adds a shared lexicon for URL and hash subjects and an index that scores from a root. If that happens we would rather join them than duplicate them, and we say so on the About page. Until then, this is one working version of the idea, in public, with its reasoning written down.

Do I need a Bluesky account?

No. Signing up creates a passkey and an AT Protocol account on our own data server, with a handle like you.attest.monster. Linking an existing Bluesky account instead is on the roadmap.

Who holds my key?

Your device does. The passkey is created and kept by your phone or computer, and synced by Apple or Google if you use their passkey sync. We store only its public half. The repository account behind it has a server-side password you never see; that part is held by us, the way any AT Protocol host holds it, which is why every record also carries your own signature.

What if I lose my phone?

Add a second passkey from another device now, on your own page. With one passkey, a lost device is a lost account. Key export is planned.

What if attest shuts down?

Your identity is a did:plc in a public directory, not a row in our database. Your records are in an AT Protocol repository that relays copy. The key that controls the accounts made here is backed up off our server, and the data is copied nightly, so the service can move to another host. The records you signed stay verifiable by anyone with your key, with or without us.

Is this a blockchain? A token?

No to both. It runs on signed records in public repositories on ordinary servers, and there is nothing to buy.

Is everything public?

Yes. That is deliberate: a trust graph only works if anyone can check it. Anything derived from it, counts and scores included, is public too. Do not sign what you would not say in public.

Can I delete something?

You can retract it, which deletes it from your repository and from our counts. Copies that relays or other services already took may persist; that is true of all public posting on AT Protocol.

Is there a score yet?

Not yet. Counts are raw today and say so. Scoring from a root you choose is the next large piece on the roadmap, and it waits until there are real vouches to score.

What stops someone making a thousand fake accounts?

Nothing stops them making the accounts. What stops them mattering is that trust flows from a key you chose through vouches, with a limit at each step, so a cluster nobody you trust has vouched for has no reach from where you stand. Newcomers start at zero on purpose.

Can I throw away an identity and start again?

Yes. Reputation belongs to a key, not a person. Starting again means starting at zero, and earning standing back takes time. That cost is what makes everyone else's standing mean something.

Can I use it on my site or app?

Yes: the integrator page has the script tag, the API and the record format. It is early and may change; the changes page records every change that matters.

Is it open source? Who runs it? What does it cost?

MIT licensed, at github.com/orbitalfoundation/attest. Run by Anselm Hook under the Orbital Foundation, built with Claude. Free. Donations to anselm.eth.

Why "monster"?

The domain was available and the mascot wanted to exist. It holds a cat's cradle, after Vonnegut: the idea that a thing can be defined entirely by its relationships.

How early is this?

Very. It was built in two days and rebuilt on AT Protocol on the second. Test data has been wiped twice and may be again before anyone relies on it. Breaking it now, and telling us, is one of the most useful things you can do.