atproto_identity
AT Protocol identity resolution (handle/DID) and inbound service-auth JWT verification for Dart/Flutter.
What this package is like to depend on
Last release 15 days ago
08 Aug 2026
Ships on a steady schedule
a new release about every 2 weeks
Nearly every release is documented
notes for 4 of 4 stable releases
Nothing withdrawn
no release was ever pulled
1 months old
4 releases · first in 2026
4 releases in the last 12 months
see the full history below
Release timeline
4 releases · Jul 2026 to Aug 2026Releases
latest 4-
0.3.008 Aug 2026Release notes
Open source →- feat: added
ensureNonReservedHost, which applies the same SSRF host policyHttpIdentityResolveruses for a PDS endpoint — rejectlocalhostand IP literals in loopback, private, link-local, CGNAT, unique-local, multicast, unspecified, or reserved ranges (unlessallowPrivateNetwork), with the same IP-literal-only limitation. Exposed so a caller that derives a further network target from resolver output can hold it to the same bar;atproto_oauthuses it to vet the authorization server taken from PDS metadata.
- feat: added
-
0.2.026 Jul 2026Release notes
Open source →- security: bounded the accepted
publicKeyMultibaselength, closing an unauthenticated quadratic-CPU denial of service.verifyServiceAuthdecodes the issuer's signing key before it verifies the signature, and base58btc decoding is O(n^2), so a DID document declaring a ~512,000-character key (small enough to fit under the resolver's 512 KiB response cap) froze the isolate for minutes on a single unauthenticated request.signingKeyOfnow throws anIdentityExceptionabove the newmaxPublicKeyMultibaseLength(256 characters; a real secp256k1 / P-256 Multikey is 49), andverifyServiceAuthre-checks the bound on whatever theIdentityResolverreturns, since that interface is caller-implementable.
- security: bounded the accepted
-
0.1.116 Jul 2026Release notes
Open source →- docs: documented the
HttpIdentityResolverSSRF/DoS hardening parameters in the README (allowedHosts,allowPrivateNetwork,timeout,maxResponseBytes), explaining whydid:webresolution needs them. - docs: documented the exported
signingKeyOf(didDocument, did)helper and its exact-id matching. - docs: showed
verifyServiceAuth'smaxTokenLifetimein the code sample. - chore: bump
did_plcto^1.1.2.
- docs: documented the
-
0.1.016 Jul 2026Release notes
Open source →- Initial release.
- feat:
IdentityResolver/HttpIdentityResolverresolve a handle (alice.example, optionally@/at://prefixed) or a DID (did:plc/did:web) to aResolvedIdentity(DID, PDS origin, handle,#atprotosigning key). Handle resolution goes throughcom.atproto.identity.resolveHandleand is verified bidirectionally against the DID document'salsoKnownAs. - feat:
verifyServiceAuthverifies an inbound AppView service-auth JWT from anAuthorization: Bearerheader and returns the issuer (viewer) DID. It validatesaud/exp/lxm/iss, resolves the issuer's#atprotosigning key, and checks the ES256K / P-256 signature viadid_plc. Fails closed: the JWTalgis not trusted, the signature must be a 64-byte compact ECDSA signature, and an out-of-rangeexpis rejected without overflow. - feat:
signingKeyOf(didDocument, did)returns thepublicKeyMultibaseof the#atprotoverification method, ornullwhen absent. - feat:
IdentityExceptionis thrown on any resolution or verification failure. - security:
HttpIdentityResolverhardensdid:webresolution against SSRF and DoS. Private, loopback, link-local, unique-local, multicast, unspecified, and otherwise reserved IP literals (andlocalhost) are rejected by default before any request is issued (allowPrivateNetwork: trueopts out; only IP literals are checked — no DNS resolution is performed, so pair with operator-level egress controls). An optionalallowedHostsallowlist restricts whichdid:webhosts may be contacted at all. Every fetch applies atimeout(default 10s) and amaxResponseBytesbody cap (default 512 KiB), anddid:webredirects are followed manually (max 5), each target re-validated against the host policy and required to behttps. - security:
verifyServiceAuthrejects bearer tokens larger than 8 KiB before any decoding and validates theissclaim against a strict DID grammar (no fragments, queries, paths, or whitespace) before handing it to the resolver. - security:
verifyServiceAuthnow validates the JWT JOSE header before any resolution work: thetyp, when present, must be a JWT media type and thealgmust be one ofES256K/ES256, failing closed onnone, HMAC (HS*), and RSA algorithms (defense in depth — the signing curve is still pinned from the DID document). - security:
verifyServiceAuthbounds the accepted token lifetime. A newmaxTokenLifetimeparameter (default 60 minutes; passnullto opt out) rejects any token whoseexpis implausibly far in the future, and theiat(not in the future) andnbf(not-before) claims are now enforced when present. A 30-second clock-skew allowance is applied consistently toexp/iat/nbf. - security:
signingKeyOfnow matches the#atprotoverification method by exact id (#atprotoor<did>#atproto) instead of aendsWith('#atproto')suffix match, preventing a crafted DID document from smuggling in a key under an id such asdid:plc:x#foo#atproto. - security:
HttpIdentityResolverbinds a fetcheddid:webdocument to the requested DID by asserting itsidequals the DID, rejecting a document that claims to describe a different DID (did:plc remains content-addressed via the trusted PLC directory).