Skip to content

README.md

Latest commit

 

History

History
91 lines (64 loc) · 3.54 KB

README.md

File metadata and controls

91 lines (64 loc) · 3.54 KB
Raw

Certified

Certified is a passwordless identity platform built on AT Protocol, operated by the Hypercerts Foundation. It lets users create an account that works across partner applications with full data portability and no vendor lock-in.

Live: certified.app

Architecture

  • certified.app -- web application for creating and managing AT Protocol identities
  • certified.one -- ePDS (extended Personal Data Server) that hosts user data

When a user signs up, they get an AT Protocol identity and a Personal Data Server hosted at certified.one. Their profile and data travel with them to any app that supports AT Protocol.

Tech stack

Routing

Route Description
/welcome Landing page (unauthenticated users redirected here from /)
/ Profile dashboard (authenticated)
/settings Account settings
/connected-apps Manage connected applications
/groups Group management
/about About Certified and the Hypercerts Foundation
/terms Terms of Service
/privacy Privacy Policy
/dsa Digital Services Act compliance

Middleware redirects unauthenticated users from / to /welcome.

Getting started

Prerequisites

Setup

# Clone the repository
git clone https://github.com/hypercerts-org/certified-app.git
cd certified-app

# Install dependencies
npm install

# Copy environment variables
cp .env.local.example .env.local

Edit .env.local with your values:

Variable Required Description
NEXT_PUBLIC_PDS_URL Yes PDS / handle resolver URL (default: https://certified.one)
PUBLIC_URL Recommended in production Canonical app origin used for OAuth metadata and callbacks
VERCEL_BRANCH_URL Vercel-provided fallback Stable branch hostname used when PUBLIC_URL is absent
VERCEL_URL Vercel-provided fallback Commit deployment hostname used when the first two values are absent
COOKIE_SECRET Production Secret for signing session cookies (openssl rand -hex 32)
UPSTASH_REDIS_REST_URL Yes Upstash Redis REST URL
UPSTASH_REDIS_REST_TOKEN Yes Upstash Redis REST token
ATPROTO_PRIVATE_KEY No EC private key for confidential client auth
RESEND_API_KEY No Resend API key for feedback emails

OAuth URL precedence is PUBLIC_URL → VERCEL_BRANCH_URL → VERCEL_URL. The Vercel variables are server-side hostname-only system values and do not need NEXT_PUBLIC_ aliases. The selected metadata endpoint—and JWKS endpoint when confidential auth is enabled—must be publicly reachable by the authorization server, so Vercel Deployment Protection can prevent preview login. Deployments participating in one callback flow must share compatible Redis configuration; distinct canonical OAuth origins should use separate Redis databases because saved OAuth sessions are not namespaced by client_id.

Development

npm run dev

Open http://localhost:3000.

Build

npm run build
npm start

License

See LICENSE for details.