IndieKey

Moving from indieauth.com

Moving your website here

indieauth.com is being replaced. Whether you need to do anything depends on how you were using it, and there is a good chance the answer is nothing at all.

Does this apply to you?

Enter your domain and this will read your home page and tell you.

Just the domain, like example.com. Nothing is saved.

Moving your site here

For the case above where indieauth.com is your server, there are three steps, and the first two can be done in one edit to your home page.

  1. Create an account and add your domain

    Sign up with a passkey, add your domain, and put the indieauth-metadata tag it gives you on your home page. Apps that support current IndieAuth switch over as soon as that tag is there. See setting up your website.

  2. Repoint your old tags — do not delete them

    Change the two tags you already have to name this server instead of indieauth.com. Your domain's page gives you the exact tags to copy.

    Deleting them instead would break things: apps that have not added indieauth-metadata support look for those tags, and indieauth.com reads authorization_endpoint to pass sign-ins through to whichever server your site names. Publish them as HTML tags rather than only as HTTP Link headers, which indieauth.com does not read.

  3. Sign in to your apps again

    Access tokens issued by tokens.indieauth.com stop working, so each app that posts to your site needs a new one. Once your domain is verified, its page lists the apps you used through indieauth.com so you know which ones to revisit.

If apps post to your website

Your Micropub or Microsub endpoint has to check the tokens it receives. If it does that the old way, by fetching tokens.indieauth.com/token, that will not work here: this server issues a JWT your endpoint can verify with a published key, or you can ask this server directly with an introspection credential. See verifying access tokens.

This is the one part of moving that may need a code change, so it is worth checking before you switch your tags.

Signing in is different here

indieauth.com signed you in through rel="me" links to GitHub, email or a PGP key. IndieKey uses a passkey on your own device instead, so there is no third-party account in the middle and nothing to leak. You can keep your rel="me" links; they are simply not used for signing in here. How this came about has the longer version.