aTIProto

createFetchKeyResolver

@atiproto/key-resolver

Returns a KeyResolver that fetches the signer's DID document over HTTPS, then extracts the public key from the named verification method. Supports did:key: (no fetch, parsed locally), did:plc: (via the PLC directory), and did:web: (via /.well-known/did.json).

Signature

typescript
function createFetchKeyResolver(
  options?: FetchKeyResolverOptions,
): KeyResolver
OptionTypeDefaultDescription
plcUrlstring"https://plc.directory"PLC directory base URL.
timeoutnumber3000Milliseconds before the fetch is aborted.
fetchtypeof fetchglobalThis.fetchOverride the global fetch (tests, custom transports).

Supported key formats

Reads both flavors of public-key material that atproto-flavored DID documents emit:

  • publicKeyMultibase: parsed as the multibase portion of a did:key: string.
  • publicKeyJwk: OKP keys (Ed25519) and EC keys (P-256, P-384, secp256k1) recognized via crv / alg.

Example

typescript
import { verify } from "@atiproto/atproto-attestation";
import { createFetchKeyResolver } from "@atiproto/key-resolver";


const keyResolver = createFetchKeyResolver({
  plcUrl: "https://plc.directory",
  timeout: 5000,
});


const result = await verify({
  record,
  repository: "did:plc:recipient",
  fields: ["items", "currency", "status"],
  keyResolver,
});

For repeated verifications against the same signers, prefer createCachedKeyResolver so each DID document is fetched once per cache TTL rather than once per record.

createDidDocumentFetcher

Lower-level companion factory exported from the same module. Returns just the DID-document fetch step without the fragment-extraction logic, for callers that want to layer their own caching or extraction on top.

typescript
function createDidDocumentFetcher(
  options?: FetchKeyResolverOptions,
): (did: string) => Promise<DidDocument>

Related