AT Protocol

Spec sheet

Purpose

AT Protocol is an open social protocol for building high-scale social applications that are interoperable by default.Read 7 Oct 2026 · atproto.com

Intended users

The protocol is aimed at developers building social applications, agents, custom feeds, and other services using shared network data.Read 7 Oct 2026 · atproto.com

Maker

The site identifies Bluesky Social PBC as the copyright holder.Read 7 Oct 2026 · atproto.com

App passwords

Accounts can create and revoke app passwords separately from their primary password.Read 7 Oct 2026 · atproto.com

Authentication

Applications can use OAuth, while single-purpose apps such as bots or command-line tools may use password authentication.Read 7 Oct 2026 · atproto.com

Authorization

OAuth is the primary mechanism for clients to make authorized requests to PDS instances, including mobile, browser, desktop, and web service clients.Read 7 Oct 2026 · atproto.com

Cryptography

AT Protocol uses public key cryptography to authenticate public data; protocol-level data encryption is not used, though many components use TLS.Read 7 Oct 2026 · atproto.com

Data model

Users publish JSON records into repositories, and record change streams sync across the network to drive applications.Read 7 Oct 2026 · atproto.com

Developer support

The official site links to tutorials, SDKs, a cookbook, deployment guidance, and community discussions on GitHub.Read 7 Oct 2026 · atproto.com

Developer use

Developers can build feeds, bots, search engines, and applications using the public firehose, with no API key required.Read 7 Oct 2026 · atproto.com

Hosting limits

Operating a relay is bandwidth intensive, while hosting an AppView is resource intensive.Read 7 Oct 2026 · atproto.com

Identity

Usernames can be domains, and account portability is supported through signed data repositories and DIDs.Read 7 Oct 2026 · atproto.com

Limited permissions

OAuth lets developers request limited account access without requiring users to share their passwords.Read 7 Oct 2026 · atproto.com

Media

Blobs include images, video, audio, or other files, and are stored separately from records.Read 7 Oct 2026 · atproto.com

Moderation

Moderation uses labels, with Osprey for event-stream decisions and analysis and Ozone for labeling and moderation decisions.Read 7 Oct 2026 · atproto.com

OAuth safeguards

The protocol's OAuth profile requires PKCE and DPoP, and does not use a client secret shared between servers and clients.Read 7 Oct 2026 · atproto.com

Public activity stream

The public firehose provides a live stream of public activity for feeds, bots, search engines, and applications, with no API key required.Read 7 Oct 2026 · atproto.com

Schemas

Lexicon schemas let separate teams define shared data and RPC formats for strongly typed APIs.Read 7 Oct 2026 · atproto.com

Schemas and APIs

Lexicons describe schemas for data and RPC calls, and provide runtime correctness checks.Read 7 Oct 2026 · atproto.com

SDKs

Bluesky Social PBC's reference SDKs are TypeScript and Go, and the TypeScript SDK works on Web, NodeJS, and React Native.Read 7 Oct 2026 · atproto.com

Self-hosting

Operators can self-host components including a PDS, Relay, Tap, AppView, and Ozone; Relay hosting is bandwidth intensive and AppView hosting is resource intensive.Read 7 Oct 2026 · atproto.com

User identity

User handles are DNS records, and user DIDs are permanent identifiers.Read 7 Oct 2026 · atproto.com

Where Specifiction places it

• Social Media APIs#6 of 208.0