AT Protocol separates identity, data, and application schemas

AT Protocol means Authenticated Transfer Protocol. It is a decentralized protocol for social web applications. The overview separates account identity, data hosting, and application views.

A DID identifies the account

A decentralized identifier is a persistent account identifier in AT Protocol, abbreviated DID. It supports the did:plc and did:web methods. The DID specification defines their use and the account’s DID document.

The overview distinguishes the DID from the human-readable handle. The identity includes cryptographic keys and a reference to the current hosting provider.

A PDS hosts the repository

A PDS is a Personal Data Server. It hosts account data, manages identity, and routes requests to other services, as the overview describes. The repository specification makes the account’s PDS the authoritative repository host. The DID document declares its location.

A repository holds the account’s public records. Its published versions have cryptographically signed commits. The repository specification describes a content-addressed Merkle tree that supports verification of records and the complete repository.

Repository paths have two parts: a collection identifier and a record key. The path rules define the collection as a namespaced identifier, or NSID.

Lexicons describe records and calls

A lexicon is a schema30 definition for records, HTTP endpoints, or event stream messages. Lexicons are JSON files identified by NSIDs. The Lexicon specification distinguishes record definitions from queries, procedures, and subscriptions.

A procedure schema describes an operation. It does not make that operation’s input a public repository record.

The overview shows how DIDs, repositories, and lexicons fit together:

DID document ── identifies keys and the current PDS
                                      │
                                      ▼
                            signed public repository
                                      │
                                      ▼
                         records described by lexicons

The repository specification makes repository contents public and verifiable. A repository signature establishes verifiability. It does not hide the record’s contents.

Read Rat King next

Rat King9 teaches how the agent-mail project uses these building blocks. It distinguishes public profile records, private runtime bindings25, and mailbox procedures. Its page also separates implemented mail clients from the public-repository roadmap.

Sources

  1. Protocol overview. Bluesky Social PBC. Protocol purpose, identity, PDS roles, and application schemas. Accessed 2026-11-05.
  2. AT Protocol DIDs. Bluesky Social PBC. Persistent account identifiers, supported DID methods, and DID documents. Accessed 2026-11-05.
  3. Repository specification. Bluesky Social PBC. Public records, signed commits, repository paths, and PDS authority. Accessed 2026-11-05.
  4. Lexicon specification. Bluesky Social PBC. Schemas for records, HTTP endpoints, and event streams. Accessed 2026-11-05.

Last changed 2026-11-05 in 5424f9d. Source on GitHub. Change log.

Linked from

  1. Agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
    Link context

    AT Protocol separates identity, data, and application schemas — AT Protocol connects persistent account identifiers, signed public repositories, hosting services, and shared schemas.

  2. Change log. What changed in the files served here, newest first.

    AT Protocol separates identity, data, and application schemas — new page: Initial commit from joelhooks/rat-stack template

  3. Full agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
  4. Rat King carries signed mail between named agents. Rat King gives agents named mailboxes, signed messages, optional encryption, and Pi, CLI, and MCP clients.

    Rat King uses AT Protocol DIDs and lexicons.

  5. Rat Stack lore | rat-stack. Short, source-grounded notes on the ideas and decisions behind rat-stack.
    Link context

    AT Protocol separates identity, data, and application schemas — AT Protocol connects persistent account identifiers, signed public repositories, hosting services, and shared schemas.

  6. Rat's Nest keeps the code public and the inventory private. Joel's purpose-built on-prem cloud uses rat-stack and Alchemy, with private inventory outside the public repo.

    See Rat King for the encrypted AT Protocol agent network.¶

  7. Source change history (log.md). The generated change log as Markdown.

    AT Protocol separates identity, data, and application schemas — new page: Initial commit from joelhooks/rat-stack template