Certified

Certified is a passwordless identity platform built on AT Protocol, operated by the Hypercerts Foundation. It lets users create an account that works across partner applications with full data portability and no vendor lock-in.

Live: certified.app

Architecture

• certified.app -- web application for creating and managing AT Protocol identities
• certified.one -- ePDS (extended Personal Data Server) that hosts user data

When a user signs up, they get an AT Protocol identity and a Personal Data Server hosted at certified.one. Their profile and data travel with them to any app that supports AT Protocol.

Tech stack

• Next.js (App Router) on Vercel
• AT Protocol OAuth with @atproto/oauth-client-node
• Upstash Redis for session and OAuth state persistence
• Tailwind CSS + custom CSS

Routing

Route	Description
/welcome	Landing page (unauthenticated users redirected here from /)
/	Profile dashboard (authenticated)
/settings	Account settings
/connected-apps	Manage connected applications
/groups	Group management
/about	About Certified and the Hypercerts Foundation
/terms	Terms of Service
/privacy	Privacy Policy
/dsa	Digital Services Act compliance

Middleware redirects unauthenticated users from / to /welcome.

Getting started

Prerequisites

• Node.js 18+
• An Upstash Redis database (free tier works)

Setup

# Clone the repository
git clone https://github.com/hypercerts-org/certified-app.git
cd certified-app

# Install dependencies
npm install

# Copy environment variables
cp .env.local.example .env.local

Edit .env.local with your values:

Variable	Required	Description
NEXT_PUBLIC_PDS_URL	Yes	PDS / handle resolver URL (default: https://certified.one)
PUBLIC_URL	Recommended in production	Canonical app origin used for OAuth metadata and callbacks
VERCEL_BRANCH_URL	Vercel-provided fallback	Stable branch hostname used when PUBLIC_URL is absent
VERCEL_URL	Vercel-provided fallback	Commit deployment hostname used when the first two values are absent
COOKIE_SECRET	Production	Secret for signing session cookies (openssl rand -hex 32)
UPSTASH_REDIS_REST_URL	Yes	Upstash Redis REST URL
UPSTASH_REDIS_REST_TOKEN	Yes	Upstash Redis REST token
ATPROTO_PRIVATE_KEY	No	EC private key for confidential client auth
RESEND_API_KEY	No	Resend API key for feedback emails

OAuth URL precedence is PUBLIC_URL → VERCEL_BRANCH_URL → VERCEL_URL. The Vercel variables are server-side hostname-only system values and do not need NEXT_PUBLIC_ aliases. The selected metadata endpoint—and JWKS endpoint when confidential auth is enabled—must be publicly reachable by the authorization server, so Vercel Deployment Protection can prevent preview login. Deployments participating in one callback flow must share compatible Redis configuration; distinct canonical OAuth origins should use separate Redis databases because saved OAuth sessions are not namespaced by client_id.

Development

npm run dev

Open http://localhost:3000.

Build

npm run build
npm start

License

See LICENSE for details.