AT Protocol Reference Implementation (TypeScript)
Welcome friends!
This repository contains Bluesky's reference implementation of AT Protocol.
About AT Protocol
The Authenticated Transfer Protocol ("ATP" or "atproto") is a decentralized social media protocol, developed by Bluesky Social PBC. Third-party software can be as seamless as first-party: custom feeds, federated services, and alternative clients are all built against the same APIs, so developers are never locked out of the ecosystems they help build. Learn more at:
The Bluesky Social application encompasses a set of schemas and APIs built in the overall AT Protocol framework. The namespace for these "Lexicons" is app.bsky.*.
What is in here?
Lexicons: for the com.atproto.* and tools.ozone.* namespaces are currently maintained in this repo under the ./lexicons/ directory. These are JSON files in the Lexicon schema definition language, similar to JSON Schema or OpenAPI. Lexicons for the app.bsky.* and chat.bsky.* namespaces are now maintained in the bluesky-social/bsky git repository, and the copies here may be out of date.
TypeScript Packages: everything under ./packages/ is published to npm under the @atproto/* scope (except for the shared utilities in ./packages/internal/, which use the @atproto-labs/* scope). Each package has its own README; packages/README.md lists them all. The short version, if you're new here:
- Building an app or bot? Start with
@atproto/lex — the type-safe SDK that generates TypeScript from Lexicon schemas and gives you an HTTP (XRPC) client. The rest of ./packages/lex/ contains its building blocks (data model, JSON/CBOR encoding, schema validation, server routing), which you rarely need to install directly. The older @atproto/api client still exists and is still used in parts of this repo, but new code should prefer @atproto/lex.
- Adding "Sign in with Atmosphere Account"? The OAuth client and server implementations live in
./packages/oauth/ — pick the client variant matching your runtime (browser, node, expo).
- Implementing atproto itself? The protocol primitives are split into focused packages: identifier parsing (
syntax), DID/handle resolution (identity, did), signing (crypto), repository & Merkle Search Tree (), and firehose consumption ().
TypeScript Services: each has its implementation in packages/<name> and a thin runtime wrapper in services/<name>.
pds: "Personal Data Server", hosting repo content for atproto accounts. See bluesky-social/pds for directions on self-hosting.bsky: AppView implementation of the app.bsky.* API endpoints, including a PostgreSQL dataplane implementation for testing. Note that the production https://api.bsky.app service uses a different dataplane which is not open source.bsync: Internal synchronization service used by the AppView for cross-service state such as mutes and notifications.ozone: Moderation service implementing the tools.ozone.* API.
What is not in here?
The source code for the Bluesky Social client app (for web and mobile) can be found at bluesky-social/social-app. TypeScript SDK packages under the @bsky/ namespace are maintained at bluesky-social/bsky.
Go programming language source code is in bluesky-social/indigo, including the BGS implementation.
Contributions
While we do accept contributions, we prioritize high quality issues and pull requests. See CONTRIBUTING.md for the developer quickstart, the rules and guidelines to follow before filing an issue or submitting a PR, and our policy on LLM-assisted contributions. Code conventions are documented in STYLE_GUIDE.md.
Security disclosures
If you discover any security issues, please send an email to [email protected]. The email is automatically CCed to the entire team, and we'll respond promptly. See SECURITY.md for more info.
License
This project is dual-licensed under MIT and Apache 2.0 terms:
Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.
Bluesky Social PBC has committed to a software patent non-aggression pledge. For details see the original announcement.
