Keytrace has just launched. Read more on the blog.

All services

npm organization Verification

How keytrace verifies npm organization identity claims

Claim URI Format

https://www.npmjs.com/package/@acme/keytrace-claim-alice

Pattern: ^https:\/\/(?:www\.)?npmjs\.com\/package\/@([a-z0-9][a-z0-9._-]*)\/([a-z0-9][a-z0-9._-]*)\/?$

Create Your Proof

  1. 1Add the did field below to the package.json of any package under your org's scope — an existing one works, or create a new one
  2. 2Run npm publish --access public to publish a version containing it
  3. 3Paste the package URL below, or the + @your-org/your-package@1.2.3 line npm prints

Proof Text

You need to include this text in your npm organization proof location:

{ "name": "@[your-org]/keytrace-claim-[your-npm-username]", "version": "0.0.1", "did": "did:plc:example123456789012345678", "publishConfig": { "access": "public" } }

Where to put it: Publish @acme/keytrace-claim-alice with your DID in the did field of package.json

Verification Steps

  1. 1

    Fetch proof data

    Using the http fetcher

    https://registry.npmjs.org/@acme/keytrace-claim-alice
  2. 2

    Search for DID in response

    The runner checks the following locations for your DID:

    • versions.*.didcontains

      Check if versions → * → did contains the DID

  3. 3

    Attestation

    If the DID is found, keytrace signs an attestation linking your identity to your ATProto DID and stores it in your repo.

Try Verification

Test verification with your own claim URI and DID: