Signed record

Save a record with an attestation signature attached.

Lexicon type: procedure

local time = require("internal.time")
local record = require("happyview.record")
local atproto = require("happyview.atproto")

function handle(input, ctx)
  local body = { text = input.text, createdAt = time.to_iso8601(time.now()) }

  local ok, sig = pcall(atproto.sign, body)
  if ok then
    body.signature = sig
  end

  local ref = record.create(ctx.collection, body)
  return { uri = ref.uri, cid = ref.cid, signature = body.signature }
end

How it works

1. Build the record body.
2. Sign it with sign on happyview.atproto. The pcall lets the script work without a signer configured, where sign raises NO_SIGNER. Signing also needs a caller: it fails when no account is signed in.
3. Attach the signature to the body as body.signature, then save the record with record.create. The record lexicon must allow a signature field, or the write is refused.
4. Return the signature alongside the URI.

The signature’s $type defaults to games.gamesgamesgamesgames.attestation. Set ATTESTATION_SIG_TYPE to use another type.

Usage

The DPoP proof is signed per request; an app built on the HappyView SDK gets this from its session.

TypeScript

const response = await fetch("http://127.0.0.1:3000/xrpc/xyz.example.createPost", {
  method: "POST",
  headers: {
    "X-Client-Key": CLIENT_KEY,
    Authorization: `DPoP ${ACCESS_TOKEN}`,
    DPoP: DPOP_PROOF,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ text: "Hello world" }),
});
const data = await response.json();

JavaScript

const response = await fetch("http://127.0.0.1:3000/xrpc/xyz.example.createPost", {
  method: "POST",
  headers: {
    "X-Client-Key": CLIENT_KEY,
    Authorization: `DPoP ${ACCESS_TOKEN}`,
    DPoP: DPOP_PROOF,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ text: "Hello world" }),
});
const data = await response.json();

Rust

let response = client
    .post("http://127.0.0.1:3000/xrpc/xyz.example.createPost")
    .header("X-Client-Key", client_key)
    .header("Authorization", format!("DPoP {access_token}"))
    .header("DPoP", dpop_proof)
    .json(&serde_json::json!({ "text": "Hello world" }))
    .send()
    .await?;

Go

body := `{ "text": "Hello world" }`
req, _ := http.NewRequest("POST", "http://127.0.0.1:3000/xrpc/xyz.example.createPost", bytes.NewBufferString(body))
req.Header.Set("X-Client-Key", clientKey)
req.Header.Set("Authorization", "DPoP "+accessToken)
req.Header.Set("DPoP", dpopProof)
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)

cURL

curl -X POST http://127.0.0.1:3000/xrpc/xyz.example.createPost \
  -H "X-Client-Key: $CLIENT_KEY" \
  -H "Authorization: DPoP $ACCESS_TOKEN" \
  -H "DPoP: $DPOP_PROOF" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Hello world" }'

{
  "uri": "at://did:plc:abc/xyz.example.post/3abc123",
  "cid": "bafyrei...",
  "signature": {
    "$type": "games.gamesgamesgamesgames.attestation",
    "key": "did:web:happyview.example.com#attestation",
    "signature": { "$bytes": "..." }
  }
}

Use case

Attestation signatures let clients verify that a record was processed by your HappyView instance — useful for contributions, moderation decisions, or cross-instance data where provenance matters. The signature covers both the record content and the author’s DID, so it can’t be replayed across users or tampered with.

See Attestation Signing for setup and configuration, or Verify Signed Record for the read-side counterpart.