Building on AT Protocol
[At Protocol](https://atproto.com/) has got me! I’m morphing into an [atmosphere nerd](https://bsky.app/profile/dbushell.com/post/3mfrkw2zc5s24).
AT Protocol — *atproto* for short — is the underlying tech that powers [Bluesky](https://dbushell.com/bluesky/) and new social web apps. Atproto as I understand it is largely an authorization and data layer.
All atproto data is inherently public. In theory it can be encrypted for private use but leaky metadata and de-anonymisation is a whole thing. Atproto users own the keys to their data which is stored on a *Personal Data Server* (PDS). You don’t need to manage your own. If you don’t know where your data is stored, good chance it’s on Bluesky’s PDS.
You can move your data to another PDS like [Blacksky](https://blackskyweb.xyz/) or [Eurosky](https://www.eurosky.tech/). Or if you’re a nerd like me [self-host your own PDS](https://dbushell.com/2026/03/02/mooving-to-a-self-hosted-bluesky-pds/). You own your data and no PDS can stop you moving it.
#### Atproto auth
Atproto provides OAuth; think *“Sign in with GitHub”*. But instead of an account being locked behind the whims of proprietary slopware, user identity is proven via their PDS.
Social apps like Bluesky host a PDS allowing users to create a new account. That account can be used to [login to other apps](https://bsky.app/profile/pckt.blog/post/3mgh4crd7ws2d) like [pckt](https://pckt.blog/), [Leaflet](https://leaflet.pub/), or [Tangled](https://tangled.org/). You could start a new account on Tangled’s PDS and use that for Bluesky. Atproto apps are not required to provide a PDS but it helps to onboard new users.
#### I built a thing!
Of course I did. You can sign in at [attic.social](https://attic.social/)
Login form for attic.social with account handle suggestions from BlueskyLogin form for attic.social with account handle suggestions from Bluesky
Attic is a cozy space with lofty ambitions. What does Attic do? I’m still deciding… it’ll probably become a random assortment of features. Right now it has bookmarks. Bookmarks will have search and tags soon.
**Technical details:** to keep the server stateless I borrowed ideas from my old [SvelteKit auth](https://github.com/dbushell/sveltekit-auth) experiment. OAuth and session state is stored in encrypted HTTP-only cookies. I used the [atcute TypeScript libraries](https://github.com/mary-ext/atcute/) to do the heavy atproto work. I found [@flo-bit’s](https://github.com/flo-bit?tab=repositories) projects which helped me understand implementation details. Attic is on Cloudflare workers for now. When I’ve free time I’ll explore the [SvelteKit Bunny adapter](https://github.com/planza-digital/sveltekit-adapter-bunny).
I am busy on client projects so I’ll be scheming Attic ideas in my free time.
#### Decentralised
What’s so powerful about atproto is that users can move their account/data. Apps write data to a PDS using a *lexicon*; a convention to say: “this is a Bluesky post”, for example. Other apps are free to read that data too. During authorization, apps must ask for permission to write to specific lexicons. The user is in control.
You may have heard that Bluesky is or isn’t “decentralised”. Bluesky was simply the first atproto app. Most users start on Bluesky and may never be aware of the AT Protocol. What’s important is that atproto makes it difficult for Bluesky to “pull a Twitter”, i.e. kill 3rd party apps, such as the alternate [Witchsky](https://witchsky.app/).
If I ever abandon [attic.social](https://attic.social/) your data is still in your hands. Even if the domain expires! You can extract data from your PDS. You can write a new app to consume it anytime. That’s the power of AT Protocol., Building on AT Protocol, dbushell.com, 01kkaebqke37dsn1c0f0peks8v.