# PLC Rotation Keys Recap Time Squad maintains two distinct PLC rotation keys: one for the production PDS service itself and another for our own accounts. While they're both stored in the same 1Password team account, they're managed and stored on separate vaults with different access controls. These keys are generated using `goat key generate` command on Andrei Jiroh's NixOS laptop ## Available keys ### Production PDS Rotation Key **Public key**: `did:key:zQ3shqgB6GTB4UDsiNCDtZwDN3knzVAaYgna8WyvPF2qPWNg9` (K-256 / secp256k1, currently in-use), `did:key:zDnaex4piMNmwKHa9JFjVujw63AdHGyADS9A4GVqWG24W11th` (P-256 / secp256r1, backup/unused) **Link to the vault item (internal only to Recap Time Squad Crew):** This key is primarily used in production by default for fresh and newly-migrated accounts on our PDS service, as set in the `PLC_ROTATION_KEY` variable in our production `.env` file (encrypted via `dotenvx`). This key is used to sign routine PLC updates like updating account handles and switching the `AtprotoPersonalDataServer`/`#atproto_pds` service in case we change `PDS_HOSTNAME` in the future. ### Recap Time Squad HQ Account-Level Rotation Key **Public key**: `did:key:zDnaeR1hzR5NrD3iQx6W91NaT9S4cctcsHsP6EMHF8isGfvUh` (P-256 / secp256r1) **Link to the vault item (internal only to the BDFL):** This key is specific to Recap Time Squad HQ-managed accounts and is used as a break-glass operation in case we can't access the PDS service or accidentally nuked everything without backups, especially on those accounts outside of our PDS. ## Delegating account recovery to Recap Time Squad's keys If you decide to trust Recap Time Squad's keys for account recovery, you can use the [add our pubkey](#recap-time-squad-hq-account-level-rotation-key) to your account via the `goat` CLI. ```bash # authenticate with your account goat account signin -u your-handle.tld -p password-goes-here # request a 2FA email token first (we'll use ABCDE-12345 as placeholder) goat account plc request-token # add the key to your Atmosphere account # optionally add --first if you want our key to be the first in the list unless you also # have your own key(s) as first on the list. goat account plc add-rotation-key --token=ABCDE-12345 did:key:zDnaeR1hzR5NrD3iQx6W91NaT9S4cctcsHsP6EMHF8isGfvUh ``` If you use the PDS Moover webapp to set up repo backups for your account or similar GUI-based tool to manage repo backups and keys, you can add our key in addition with your own keys when prompted. Alternatively, you can migrate to our PDS instance instead since it will automatically use the PDS-wide rotation keys once you complete the migration flow. To initiate the account recovery flow, [contact Andrei Jiroh](https://andreijiroh.dev/contact) with the details about your situation (i.e. account handle, whether your account was banned (aka takendown) for any reason or not (hacked servers/account takeovers also count here), and whether you have backups of your account data). If you do have your own keys added to your account, we recommend doing the self-serve recovery flow first at unless you lost it. You will be asked to verify your identity by showing proof of account ownership (i.e. email address used to create that account OR the current one on your current/former PDS) to protect your account from unauthorized access and minimize social engineering attacks. ### Account Recovery Cookbook See [Using your key for recovery in the AT Proto Docs about Account Recovery](https://atproto.com/guides/account-recovery#using-your-key-for-recovery) and [David Bunchanan's guide on adversarial PDS migration](https://www.da.vidbuchanan.co.uk/blog/adversarial-pds-migration.html) for details. We recommend having a backup of your/their account data such as repository CAR files, blobs, and private data (i.e. app preferences) handy for this process. For those who entrusted us with account recovery by adding our keys to their account, make surechore(git you have access to the private keys [as documented above](#available-keys) before proceeding with the recovery process. If they sent us the details on where PDS to switch to rather than just using ours, make sure they have received a invite code to the PDS they want to switch to if required.