All services
npm organization Verification
How keytrace verifies npm organization identity claims
Claim URI Format
https://www.npmjs.com/package/@acme/keytrace-claim-alice Pattern: ^https:\/\/(?:www\.)?npmjs\.com\/package\/@([a-z0-9][a-z0-9._-]*)\/([a-z0-9][a-z0-9._-]*)\/?$
Create Your Proof
- 1Add the
didfield below to thepackage.jsonof any package under your org's scope — an existing one works, or create a new one - 2Run
npm publish --access publicto publish a version containing it - 3Paste the package URL below, or the
+ @your-org/your-package@1.2.3line npm prints
Proof Text
You need to include this text in your npm organization proof location:
{
"name": "@[your-org]/keytrace-claim-[your-npm-username]",
"version": "0.0.1",
"did": "did:plc:example123456789012345678",
"publishConfig": { "access": "public" }
}Where to put it: Publish @acme/keytrace-claim-alice with your DID in the did field of package.json
Verification Steps
- 1
Fetch proof data
Using the
httpfetcherhttps://registry.npmjs.org/@acme/keytrace-claim-alice - 2
Search for DID in response
The runner checks the following locations for your DID:
versions.*.didcontainsCheck if versions → * → did contains the DID
- 3
Attestation
If the DID is found, keytrace signs an attestation linking your identity to your ATProto DID and stores it in your repo.
Try Verification
Test verification with your own claim URI and DID: