IndieKey

Moving from indieauth.com

Moving your website here

indieauth.com is being replaced. Whether you need to do anything depends on how you were using it, and there is a good chance the answer is nothing at all.

Does this apply to you?

Enter your domain and this will read your home page and tell you.

Just the domain, like example.com. Nothing is saved.

Moving your site here

For the case above where indieauth.com is your server, there are three steps, and the first two can be done in one edit to your home page.

  1. Create an account and add your domain

    Sign up with a passkey, add your domain, and put the indieauth-metadata tag it gives you on your home page. Apps that support current IndieAuth switch over as soon as that tag is there. See setting up your website.

  2. Repoint your old tags — do not delete them

    Change the two tags you already have to name this server instead of indieauth.com. Your domain's page gives you the exact tags to copy.

    Deleting them instead would break things: apps that have not added indieauth-metadata support look for those tags, and indieauth.com reads authorization_endpoint to pass sign-ins through to whichever server your site names. Publish them as HTML tags rather than only as HTTP Link headers, which indieauth.com does not read.

  3. Keep your apps' tokens working

    Apps that post to your site hold tokens from tokens.indieauth.com. Once your domain is verified, its page has a switch that lets this server answer for those tokens, so the apps keep working without signing in again. The same page lists the apps you used through indieauth.com, so you know which to sign in to again before you eventually turn the switch off.

If apps post to your website

Your Micropub or Microsub endpoint has to check the tokens it receives. If it does that the old way, by fetching https://tokens.indieauth.com/token, it can keep doing so here. Turn on the old token check on your domain's page, and change that one URL in your endpoint to https://indiekey.id/token. It gets the same answer as before, in the same format. If your endpoint finds its token endpoint from your home page's tags instead, repointing the tags is all it needs.

The old check is a stopgap, offered only to websites that held tokens from indieauth.com. When you can, move your endpoint to verifying the JWT this server issues, or to asking this server with an introspection credential. See verifying access tokens.

Signing in is different here

indieauth.com signed you in through rel="me" links to GitHub, email or a PGP key. IndieKey uses a passkey on your own device instead, so there is no third-party account in the middle and nothing to leak. You can keep your rel="me" links; they are simply not used for signing in here. How this came about has the longer version.