Certified
Certified is a passwordless identity platform built on AT Protocol, operated by the Hypercerts Foundation. It lets users create an account that works across partner applications with full data portability and no vendor lock-in.
Live: certified.app
Architecture
- certified.app -- web application for creating and managing AT Protocol identities
- certified.one -- ePDS (extended Personal Data Server) that hosts user data
When a user signs up, they get an AT Protocol identity and a Personal Data Server hosted at certified.one. Their profile and data travel with them to any app that supports AT Protocol.
Tech stack
Routing
| Route | Description |
|---|
/welcome | Landing page (unauthenticated users redirected here from /) |
/ | Profile dashboard (authenticated) |
/settings | Account settings |
/connected-apps | Manage connected applications |
/groups | Group management |
/about | About Certified and the Hypercerts Foundation |
/terms | Terms of Service |
/privacy | Privacy Policy |
/dsa | Digital Services Act compliance |
Middleware redirects unauthenticated users from / to /welcome.
Getting started
Prerequisites
Setup
# Clone the repository
git clone https://github.com/hypercerts-org/certified-app.git
cd certified-app
# Install dependencies
npm install
# Copy environment variables
cp .env.local.example .env.local
Edit .env.local with your values:
| Variable | Required | Description |
|---|
NEXT_PUBLIC_PDS_URL | Yes | PDS / handle resolver URL (default: https://certified.one) |
PUBLIC_URL | Recommended in production | Canonical app origin used for OAuth metadata and callbacks |
VERCEL_BRANCH_URL | Vercel-provided fallback | Stable branch hostname used when PUBLIC_URL is absent |
VERCEL_URL | Vercel-provided fallback | Commit deployment hostname used when the first two values are absent |
COOKIE_SECRET | Production | Secret for signing session cookies (openssl rand -hex 32) |
UPSTASH_REDIS_REST_URL | Yes | Upstash Redis REST URL |
UPSTASH_REDIS_REST_TOKEN | Yes | Upstash Redis REST token |
ATPROTO_PRIVATE_KEY | No | EC private key for confidential client auth |
RESEND_API_KEY | No | Resend API key for feedback emails |
OAuth URL precedence is PUBLIC_URL → VERCEL_BRANCH_URL → VERCEL_URL. The Vercel variables are server-side hostname-only system values and do not need NEXT_PUBLIC_ aliases. The selected metadata endpoint—and JWKS endpoint when confidential auth is enabled—must be publicly reachable by the authorization server, so Vercel Deployment Protection can prevent preview login. Deployments participating in one callback flow must share compatible Redis configuration; distinct canonical OAuth origins should use separate Redis databases because saved OAuth sessions are not namespaced by client_id.
Development
npm run dev
Open http://localhost:3000.
Build
npm run build
npm start
License
See LICENSE for details.
