Hold the keys to your own identity.
Obsign is an iOS identity wallet for the AT Protocol, the network behind Bluesky. The keys that control your account live in your device’s Secure Enclave, not on someone else’s server. Your posts and media can back up to your own iCloud Drive. No platform, host, or provider can take your identity, block your exit, or hold it hostage.
Open source, and in active development: iOS builds ship via TestFlight.
Your account is a promise someone else keeps.
On the AT Protocol, your account is a public record, and whoever holds its keys controls it. On most hosts today, that’s the server. Your ability to leave, to recover from an attack, or simply to stay yourself is a policy promise: real only for as long as your host is honest, solvent, and online.
Obsign turns that promise into arithmetic. Your device holds the key that outranks all the others, so the final word on your account is signed by you — and only ever by you. Your wallet also creates a recovery key and splits it into three shares: one in your device’s Keychain, one escrowed with your server, one yours to keep offline. Any two rebuild the key. A dishonest host holds a single share it can do nothing with; the two you hold are enough to bring your account back.
- your device
- holds the deciding key, sealed in the Secure Enclave
- your backup
- a recovery key, split into three shares — any two rebuild it, no single custodian
- your server
- signs posts; its key can never outrank yours
- recovery window
- 72 hours, during which your keys override the server’s
How Obsign defends an account.
Set it up once, with care. After that, Obsign watches quietly, and if something is wrong, it says so in plain words.
Sealed in your device
Your account key is generated inside the Secure Enclave and never leaves it. It signs account operations only after you approve them: reviewed on screen, confirmed with your biometrics.
It keeps watch
Obsign watches the network’s public record of your account. Every change is checked against your own key: any operation you didn’t authorize raises an alarm that tells you exactly what changed.
72 hours to take it back
Inside the recovery window, your device key outranks every other key. One clear, reviewed action signs the override and reclaims the account, before the window closes.
Backup without your server
At setup, your device creates a recovery secret and splits it into three shares: your device’s Keychain, your server’s escrow, and a place you choose. Any two bring your account back; no single share (and no single company) can.
Leaving is allowed. That’s the point.
Because the deciding key is yours, moving your account to a new host is an operation you sign: it never requires your old server’s permission, cooperation, or continued existence. Credible exit stops being a promise in someone’s terms of service and becomes a property of the keys.
And nothing about this leaves the network behind: your server keeps an ordinary key of its own, so standard AT Protocol tooling and ordinary migrations keep working as they do everywhere else.
Turn on backup and leaving gets safer still: Obsign keeps your own copy of your posts and media in your iCloud Drive — your records as a portable snapshot, your photos and video byte for byte — so even a move away from a server that has already lost some of your content isn’t a loss.
Plain answers.
What if I lose my phone?
Your recovery secret is split three ways at setup: one share in your device’s Keychain, one held in escrow by your server, one wherever you choose. Losing the phone loses at most one share; any two bring your identity back on a new device.
Do I need to understand the cryptography?
No, and you’re never asked to. Setup is a few plain questions; the machinery stays out of the way. If you’re curious about what’s happening underneath, the details are a few taps away.
What about my posts and photos?
Your server backs up its records off-box continuously, and your media on a regular sweep. And Obsign can keep your own copy of both — your posts and your media — in your iCloud Drive, so your whole presence stays with you even if the server that held it disappears.
What if this project disappears?
Your identity outlives it. It lives in the network’s public directory, your keys are on your device, and your server still holds a standard key, so ordinary AT Protocol tooling can still operate on your identity. All of this is open source.
Be first in line for the TestFlight.
Obsign is opening to early testers. Leave an email and we’ll send you the TestFlight invite when your spot opens. Already on Bluesky or the AT Protocol? Add your handle — bringing an existing account is what Obsign is built for, and it helps us know how many of you are coming with one.
One email when the TestFlight opens — nothing else, and no sharing. Your address lives on our own server (Custos, naturally), and your handle is only ever read as a “coming with an existing account” signal — we don’t touch the account itself.
custos the server side
Run the server your account lives in.
Custos is Obsign’s personal data server, a complete AT Protocol PDS in a single Rust binary. It hosts your repository, signs your posts, and federates with the network. What it cannot do, by construction, is take your account: its key is ranked below yours.