diff --git a/js/app/components/aqlink.tsx b/js/app/components/aqlink.tsx
index 4e47edebc..b6a50c834 100644
--- a/js/app/components/aqlink.tsx
+++ b/js/app/components/aqlink.tsx
@@ -16,10 +16,13 @@ export default function AQLink({
 }) {
   const { isWeb } = usePlatform();
   const navigation = useNavigation<NavigationProp<ParamListBase>>();
+  const baseStyle: StyleProp<ViewStyle> = {
+    display: "flex",
+  };
 
   if (isWeb) {
     return (
-      <Link style={style} to={to as any}>
+      <Link style={[baseStyle, style]} to={to as any}>
         {children}
       </Link>
     );
@@ -27,7 +30,7 @@ export default function AQLink({
 
   return (
     <Pressable
-      style={style}
+      style={[baseStyle, style]}
       onPress={() => navigation.navigate(to.screen, to.params)}
     >
       {children}
diff --git a/js/app/components/golive.tsx b/js/app/components/golive.tsx
deleted file mode 100644
index 45c3ed4c3..000000000
--- a/js/app/components/golive.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-import { useEffect, useState } from "react";
-import { Button, Label, Paragraph, TextArea, View } from "tamagui";
-import Loading from "./loading/loading";
-import { useToastController } from "@tamagui/toast";
-import useAquareumNode from "hooks/useAquareumNode";
-import { golivePost, selectUserProfile } from "features/bluesky/blueskySlice";
-import { useAppDispatch, useAppSelector } from "store/hooks";
-import AQLink from "./aqlink";
-import { getIdentity, selectAquareum } from "features/aquareum/aquareumSlice";
-
-const Left = ({ children }: { children: React.ReactNode }) => {
-  return (
-    <View f={2} fb={0}>
-      {children}
-    </View>
-  );
-};
-
-const Right = ({ children }: { children: React.ReactNode }) => {
-  return (
-    <View f={6} fb={0} alignItems="stretch">
-      {children}
-    </View>
-  );
-};
-type Settings = {
-  id: string;
-  streamer: string;
-  title: string;
-};
-
-export default function GoLive() {
-  const toast = useToastController();
-  const { url } = useAquareumNode();
-  const profile = useAppSelector(selectUserProfile);
-  const dispatch = useAppDispatch();
-  const aquareum = useAppSelector(selectAquareum);
-  useEffect(() => {
-    if (!aquareum.identity) {
-      dispatch(getIdentity());
-    }
-  }, [aquareum.identity]);
-  const [title, setTitle] = useState("");
-  const [loading, setLoading] = useState(false);
-  const disabled = !profile || loading || title === "";
-  if (!aquareum.identity) {
-    return (
-      <View f={1} ai="center" jc="center" w="100%" p="$4">
-        <Loading />
-      </View>
-    );
-  }
-  const identity = aquareum.identity;
-  return (
-    <View f={1} ai="center" jc="center" gap="$4" w="100%" p="$4" maxWidth={500}>
-      <Label w="100%">
-        <Left>
-          <Paragraph>Signing Key ID</Paragraph>
-        </Left>
-        <Right>
-          <Paragraph>{identity.id}</Paragraph>
-        </Right>
-      </Label>
-      <Label w="100%">
-        <Left>
-          <Paragraph>Streamer</Paragraph>
-        </Left>
-        <Right>
-          {!profile && (
-            <AQLink to={{ screen: "Login" }} style={{ display: "flex" }}>
-              <Paragraph color="$accentColor">Log in with Bluesky</Paragraph>
-            </AQLink>
-          )}
-          {profile && <Paragraph>@{identity.handle}</Paragraph>}
-        </Right>
-      </Label>
-      <Label w="100%">
-        <Left>
-          <Paragraph>ATProto DID</Paragraph>
-        </Left>
-        <Right>
-          <Paragraph>{aquareum.identity.did}</Paragraph>
-        </Right>
-      </Label>
-      <Label w="100%">
-        <Left>
-          <Paragraph pb="$2">Title</Paragraph>
-        </Left>
-        <Right>
-          <TextArea
-            value={title}
-            onChangeText={setTitle}
-            w="100%"
-            size="$4"
-            minHeight={100}
-          />
-        </Right>
-      </Label>
-      <View gap="$2" w="100%">
-        <Button
-          disabled={disabled}
-          opacity={disabled ? 0.5 : 1}
-          w="100%"
-          size="$4"
-          onPress={async () => {
-            setLoading(true);
-            if (!url) {
-              throw new Error("No node URL");
-            }
-            try {
-              await dispatch(
-                golivePost({
-                  nodeUrl: url,
-                  signingKey: identity.id,
-                  text: title,
-                }),
-              );
-              toast.show("Posted!", {
-                message: `Great success!`,
-              });
-            } catch (e) {
-              toast.show("Error creating post", {
-                message: e.mesasge,
-              });
-            } finally {
-              setLoading(false);
-            }
-          }}
-        >
-          {loading ? "Loading..." : "Save"}
-        </Button>
-      </View>
-    </View>
-  );
-}
diff --git a/js/app/components/login/login.tsx b/js/app/components/login/login.tsx
index ae41ea028..2da0a2578 100644
--- a/js/app/components/login/login.tsx
+++ b/js/app/components/login/login.tsx
@@ -16,7 +16,6 @@ export default function Login() {
   const userProfile = useAppSelector(selectUserProfile);
   const pds = useAppSelector(selectPDS);
   const loginState = useAppSelector(selectLogin);
-  console.log("pds", pds);
   const [open, setOpen] = useState(false);
   const onOpenChange = (open: boolean) => {
     setOpen(open);
diff --git a/js/app/components/player/use-webrtc.tsx b/js/app/components/player/use-webrtc.tsx
index 2e9ed7bf6..df303a74a 100644
--- a/js/app/components/player/use-webrtc.tsx
+++ b/js/app/components/player/use-webrtc.tsx
@@ -1,7 +1,11 @@
 import { useEffect, useState } from "react";
 import { RTCPeerConnection, RTCSessionDescription } from "./webrtc-primitives";
 import { usePlayerActions } from "features/player/playerSlice";
-import { useAppDispatch } from "store/hooks";
+import { useAppDispatch, useAppSelector } from "store/hooks";
+import {
+  createStreamKeyRecord,
+  selectStoredKey,
+} from "features/bluesky/blueskySlice";
 
 export default function useWebRTC(endpoint: string) {
   const [mediaStream, setMediaStream] = useState<MediaStream | null>(null);
@@ -54,6 +58,7 @@ export default function useWebRTC(endpoint: string) {
 export async function negotiateConnectionWithClientOffer(
   peerConnection: RTCPeerConnection,
   endpoint: string,
+  bearerToken?: string,
 ) {
   /** https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/createOffer */
   const offer = await peerConnection.createOffer({
@@ -80,7 +85,7 @@ export async function negotiateConnectionWithClientOffer(
        * and what kind of media client and server have negotiated to exchange.
        */
       console.log(`posting sdp offer: ${endpoint}`);
-      let response = await postSDPOffer(endpoint, ofr.sdp);
+      let response = await postSDPOffer(endpoint, ofr.sdp, bearerToken);
       if (response.status === 201) {
         let answerSDP = await response.text();
         await peerConnection.setRemoteDescription(
@@ -104,12 +109,17 @@ export async function negotiateConnectionWithClientOffer(
   }
 }
 
-async function postSDPOffer(endpoint: string, data: string) {
+async function postSDPOffer(
+  endpoint: string,
+  data: string,
+  bearerToken?: string,
+) {
   return await fetch(endpoint, {
     method: "POST",
     mode: "cors",
     headers: {
       "content-type": "application/sdp",
+      ...(bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {}),
     },
     body: data,
   });
@@ -146,10 +156,20 @@ export function useWebRTCIngest(
   const [mediaStream, setMediaStream] = useState<MediaStream | null>(null);
   const { ingestConnectionState } = usePlayerActions();
   const dispatch = useAppDispatch();
+  const storedKey = useAppSelector(selectStoredKey);
+  useEffect(() => {
+    if (storedKey) {
+      return;
+    }
+    dispatch(createStreamKeyRecord({ store: true }));
+  }, [storedKey]);
   useEffect(() => {
     if (!mediaStream) {
       return;
     }
+    if (!storedKey) {
+      return;
+    }
     console.log("creating peer connection");
     const peerConnection = new RTCPeerConnection({
       bundlePolicy: "max-bundle",
@@ -165,12 +185,16 @@ export function useWebRTCIngest(
       }
     });
     peerConnection.addEventListener("negotiationneeded", (ev) => {
-      negotiateConnectionWithClientOffer(peerConnection, endpoint);
+      negotiateConnectionWithClientOffer(
+        peerConnection,
+        endpoint,
+        storedKey.privateKey,
+      );
     });
 
     return () => {
       peerConnection.close();
     };
-  }, [endpoint, mediaStream]);
+  }, [endpoint, mediaStream, storedKey]);
   return [mediaStream, setMediaStream];
 }
diff --git a/js/app/components/player/video.tsx b/js/app/components/player/video.tsx
index cbdaf367c..aa500238a 100644
--- a/js/app/components/player/video.tsx
+++ b/js/app/components/player/video.tsx
@@ -20,7 +20,8 @@ import { srcToUrl } from "./shared";
 import useWebRTC, { useWebRTCIngest } from "./use-webrtc";
 import useAquareumNode from "hooks/useAquareumNode";
 import { selectPlayer } from "features/player/playerSlice";
-import { useAppSelector } from "store/hooks";
+import { useAppDispatch, useAppSelector } from "store/hooks";
+import { selectStoredKey } from "features/bluesky/blueskySlice";
 
 type VideoProps = PlayerProps & { url: string };
 
@@ -124,7 +125,7 @@ const VideoElement = forwardRef(
             backgroundColor: "transparent",
             width: "100%",
             height: "100%",
-            // transform: props.ingest ? "scaleX(-1)" : undefined,
+            transform: props.ingest ? "scaleX(-1)" : undefined,
           }}
         />
       </View>
@@ -212,7 +213,9 @@ export function WebRTCPlayer(
 export function WebcamIngestPlayer(
   props: VideoProps & { videoRef: RefObject<HTMLVideoElement> },
 ) {
+  const dispatch = useAppDispatch();
   const player = useAppSelector(selectPlayer);
+  const storedKey = useAppSelector(selectStoredKey);
   const [videoElement, setVideoElement] = useState<HTMLVideoElement | null>(
     null,
   );
@@ -252,8 +255,11 @@ export function WebcamIngestPlayer(
     if (!localMediaStream) {
       return;
     }
+    if (!storedKey) {
+      return;
+    }
     setRemoteMediaStream(localMediaStream);
-  }, [localMediaStream, player.ingestStarting]);
+  }, [localMediaStream, player.ingestStarting, storedKey]);
 
   useEffect(() => {
     if (!videoElement) {
diff --git a/js/app/features/base/baseSlice.tsx b/js/app/features/base/baseSlice.tsx
new file mode 100644
index 000000000..727f229dd
--- /dev/null
+++ b/js/app/features/base/baseSlice.tsx
@@ -0,0 +1,56 @@
+import { createAppSlice } from "../../hooks/createSlice";
+import Storage from "../../storage";
+export const STORED_KEY_KEY = "storedKey";
+
+export interface StreamKey {
+  privateKey: string;
+  did: string;
+  address: string;
+}
+
+export interface BaseState {
+  hydrated: boolean;
+}
+
+const initialState: BaseState = {
+  hydrated: false,
+};
+
+export const baseSlice = createAppSlice({
+  name: "base",
+  initialState,
+  reducers: (create) => ({
+    hydrate: create.asyncThunk(
+      async () => {
+        let storedKey: StreamKey | null = null;
+        // Async operation would go here
+        try {
+          const storedKeyStr = await Storage.getItem(STORED_KEY_KEY);
+          if (storedKeyStr) {
+            storedKey = JSON.parse(storedKeyStr);
+          }
+        } catch (e) {
+          // we don't have one i guess
+        }
+        return { storedKey };
+      },
+      {
+        pending: (state) => {
+          state.hydrated = false;
+        },
+        fulfilled: (state) => {
+          state.hydrated = true;
+        },
+        rejected: (state) => {
+          state.hydrated = false;
+        },
+      },
+    ),
+  }),
+  selectors: {
+    selectHydrated: (state) => state.hydrated,
+  },
+});
+
+export const { hydrate } = baseSlice.actions;
+export const { selectHydrated } = baseSlice.selectors;
diff --git a/js/app/features/bluesky/blueskySlice.tsx b/js/app/features/bluesky/blueskySlice.tsx
index 6af1ae295..4a2e9085e 100644
--- a/js/app/features/bluesky/blueskySlice.tsx
+++ b/js/app/features/bluesky/blueskySlice.tsx
@@ -6,6 +6,11 @@ import { openLoginLink } from "features/platform/platformSlice";
 import Storage from "storage";
 import { createAppSlice } from "../../hooks/createSlice";
 import createOAuthClient, { AquareumOAuthClient } from "./oauthClient";
+import { Secp256k1Keypair, bytesToMultibase } from "@atproto/crypto";
+import { privateKeyToAccount } from "viem/accounts";
+import { StreamKey } from "features/base/baseSlice";
+import { hydrate, STORED_KEY_KEY } from "features/base/baseSlice";
+
 export interface BlueskyState {
   status: "start" | "loggedIn" | "loggedOut";
   oauthState: null | string;
@@ -22,6 +27,8 @@ export interface BlueskyState {
     loading: boolean;
     error: null | string;
   };
+  newKey: null | StreamKey;
+  storedKey: null | StreamKey;
 }
 
 const initialState: BlueskyState = {
@@ -40,11 +47,21 @@ const initialState: BlueskyState = {
     loading: false,
     error: null,
   },
+  newKey: null,
+  storedKey: null,
 };
 
 export const blueskySlice = createAppSlice({
   name: "bluesky",
   initialState,
+  extraReducers: (builder) => {
+    builder.addCase(hydrate.fulfilled, (state, action) => {
+      return {
+        ...state,
+        storedKey: action.payload.storedKey,
+      };
+    });
+  },
   reducers: (create) => ({
     loadOAuthClient: create.asyncThunk(
       async (_, { getState }) => {
@@ -313,6 +330,78 @@ export const blueskySlice = createAppSlice({
         },
       },
     ),
+
+    createStreamKeyRecord: create.asyncThunk(
+      async ({ store }: { store: boolean }, thunkAPI) => {
+        const { bluesky } = thunkAPI.getState() as {
+          bluesky: BlueskyState;
+        };
+        if (!bluesky.pdsAgent) {
+          throw new Error("No agent");
+        }
+        const did = bluesky.oauthSession?.did;
+        if (!did) {
+          throw new Error("No DID");
+        }
+        const profile = bluesky.profiles[did];
+        if (!profile) {
+          throw new Error("No profile");
+        }
+        if (!did) {
+          throw new Error("No DID");
+        }
+        const keypair = await Secp256k1Keypair.create({ exportable: true });
+        const exportedKey = await keypair.export();
+        const didBytes = new TextEncoder().encode(did);
+        const combinedKey = new Uint8Array([...exportedKey, ...didBytes]);
+        const multibaseKey = bytesToMultibase(combinedKey, "base58btc");
+        const hexKey = Array.from(exportedKey)
+          .map((b) => b.toString(16).padStart(2, "0"))
+          .join("");
+        const account = await privateKeyToAccount(`0x${hexKey}`);
+        const newKey = {
+          privateKey: multibaseKey,
+          did: keypair.did(),
+          address: account.address.toLowerCase(),
+        };
+        const record = {
+          signingKey: keypair.did(),
+        };
+        await bluesky.pdsAgent.com.atproto.repo.createRecord({
+          repo: did,
+          collection: "place.stream.key",
+          record,
+        });
+        if (store) {
+          await Storage.setItem(STORED_KEY_KEY, JSON.stringify(newKey));
+        }
+        return newKey;
+      },
+      {
+        pending: (state) => {
+          console.log("golivePost pending");
+        },
+        fulfilled: (state, action) => {
+          return {
+            ...state,
+            newKey: action.payload,
+            storedKey: action.meta.arg.store ? action.payload : null,
+          };
+        },
+        rejected: (state, action) => {
+          console.error("getProfile rejected", action.error);
+          // state.status = "failed";
+        },
+      },
+    ),
+
+    clearStreamKeyRecord: create.reducer((state) => {
+      return {
+        ...state,
+        newKey: null,
+      };
+    }),
+
     setPDS: create.asyncThunk(
       async (pds: string, thunkAPI) => {
         await Storage.setItem("pdsURL", pds);
@@ -361,11 +450,27 @@ export const blueskySlice = createAppSlice({
     selectPDS: (bluesky) => bluesky.pds,
     selectLogin: (bluesky) => bluesky.login,
     selectProfiles: (bluesky) => bluesky.profiles,
+    selectStoredKey: (bluesky) => bluesky.storedKey,
     selectUserProfile: (bluesky) => {
       const did = bluesky.oauthSession?.did;
       if (!did) return null;
       return bluesky.profiles[did];
     },
+    selectIsReady: (bluesky) => {
+      if (bluesky.status === "start") {
+        return false;
+      } else if (bluesky.status === "loggedOut") {
+        return true;
+      }
+      if (!bluesky.oauthSession) {
+        return false;
+      }
+      const profile = blueskySlice.selectors.selectUserProfile({ bluesky });
+      if (!profile) {
+        return false;
+      }
+      return true;
+    },
   },
 });
 
@@ -378,6 +483,8 @@ export const {
   golivePost,
   oauthCallback,
   setPDS,
+  createStreamKeyRecord,
+  clearStreamKeyRecord,
 } = blueskySlice.actions;
 
 // Selectors returned by `slice.selectors` take the root state as their first argument.
@@ -387,4 +494,5 @@ export const {
   selectUserProfile,
   selectPDS,
   selectLogin,
+  selectStoredKey,
 } = blueskySlice.selectors;
diff --git a/js/app/package.json b/js/app/package.json
index c0205ba9c..6456b1102 100644
--- a/js/app/package.json
+++ b/js/app/package.json
@@ -27,6 +27,7 @@
   "dependencies": {
     "@aquareum/atproto-oauth-client-react-native": "^0.0.1",
     "@atproto-labs/pipe": "^0.1.0",
+    "@atproto/crypto": "^0.4.2",
     "@atproto/jwk-jose": "^0.1.2",
     "@atproto/oauth-client": "^0.3.1",
     "@bacons/text-decoder": "^0.0.0",
@@ -63,6 +64,7 @@
     "expo-web-browser": "^14.0.1",
     "hls.js": "^1.5.17",
     "jose": "^5.9.6",
+    "multiformats": "^13.3.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "react-native": "0.76.2",
diff --git a/js/app/src/router.tsx b/js/app/src/router.tsx
index c3be292da..5aaf409c9 100644
--- a/js/app/src/router.tsx
+++ b/js/app/src/router.tsx
@@ -29,15 +29,16 @@ import {
   Pressable,
   StatusBar,
 } from "react-native";
-import { useAppSelector } from "store/hooks";
+import { useAppDispatch, useAppSelector } from "store/hooks";
 import { Text, useTheme, View } from "tamagui";
 import AppReturnScreen from "./screens/app-return";
-import GoLiveScreen from "./screens/golive";
 import LiveScreen from "./screens/live";
 import MultiScreen from "./screens/multi";
 import StreamScreen from "./screens/stream";
 import SupportScreen from "./screens/support";
 import WebcamScreen from "./screens/webcam";
+import StreamKeyScreen from "./screens/stream-key";
+import { hydrate, selectHydrated } from "features/base/baseSlice";
 function HomeScreen() {
   return (
     <View f={1}>
@@ -65,6 +66,7 @@ const linking: LinkingOptions<ReactNavigation.RootParamList> = {
       GoLive: "golive",
       Live: "live",
       Webcam: "live/webcam",
+      StreamKey: "live/stream-key",
       Login: "login",
       AppReturn: "app-return/:scheme",
     },
@@ -141,7 +143,9 @@ export function AquareumDrawer() {
   const theme = useTheme();
   const { isWeb, isElectron } = usePlatform();
   const navigation = useNavigation();
+  const dispatch = useAppDispatch();
   useEffect(() => {
+    dispatch(hydrate());
     // const params = new URLSearchParams(document.location.search);
     // if (params.has("code")) {
     //   navigation.dispatch(
@@ -152,6 +156,10 @@ export function AquareumDrawer() {
     //   );
     // }
   }, []);
+  const hydrated = useAppSelector(selectHydrated);
+  if (!hydrated) {
+    return <View />;
+  }
   return (
     <>
       <StatusBar backgroundColor={theme.background.val} />
@@ -161,6 +169,7 @@ export function AquareumDrawer() {
           headerLeft: () => <NavigationButton />,
           headerRight: () => <AvatarButton />,
           drawerActiveTintColor: theme.accentColor.val,
+          unmountOnBlur: true,
         }}
       >
         <Drawer.Screen
@@ -168,6 +177,7 @@ export function AquareumDrawer() {
           component={MainTab}
           options={{
             drawerIcon: () => <Home />,
+            drawerLabel: () => <Text>Home</Text>,
             headerTitle: "Aquareum",
             headerShown: isWeb,
             title: "Aquareum",
@@ -194,7 +204,10 @@ export function AquareumDrawer() {
         <Drawer.Screen
           name="Settings"
           component={Settings}
-          options={{ drawerIcon: () => <SettingsIcon /> }}
+          options={{
+            drawerIcon: () => <SettingsIcon />,
+            drawerLabel: () => <Text>Settings</Text>,
+          }}
         />
         <Drawer.Screen
           name="Multi"
@@ -208,7 +221,7 @@ export function AquareumDrawer() {
           name="Support"
           component={SupportScreen}
           options={{
-            drawerLabel: () => null,
+            drawerLabel: () => <Text>Support</Text>,
             drawerItemStyle: { display: "none" },
           }}
         />
@@ -236,18 +249,22 @@ export function AquareumDrawer() {
             drawerItemStyle: { display: "none" },
           }}
         />
+        <Drawer.Screen
+          name="StreamKey"
+          component={StreamKeyScreen}
+          options={{
+            drawerLabel: () => null,
+            drawerItemStyle: { display: "none" },
+          }}
+        />
         <Drawer.Screen
           name="Login"
           component={Login}
-          options={{ drawerIcon: () => <LogIn /> }}
+          options={{
+            drawerIcon: () => <LogIn />,
+            drawerLabel: () => <Text>Login</Text>,
+          }}
         />
-        {isElectron && (
-          <Drawer.Screen
-            name="GoLive"
-            component={GoLiveScreen}
-            options={{ headerTitle: "Go Live", drawerIcon: () => <Video /> }}
-          />
-        )}
       </Drawer.Navigator>
     </>
   );
diff --git a/js/app/src/screens/golive.tsx b/js/app/src/screens/golive.tsx
deleted file mode 100644
index f8c125c9f..000000000
--- a/js/app/src/screens/golive.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-import GoLive from "components/golive";
-import { View } from "tamagui";
-
-export default function GoLiveScreen() {
-  return (
-    <View f={1} ai="center" jc="center">
-      <GoLive />
-    </View>
-  );
-}
diff --git a/js/app/src/screens/live.tsx b/js/app/src/screens/live.tsx
index de2556f6e..7402a5c5f 100644
--- a/js/app/src/screens/live.tsx
+++ b/js/app/src/screens/live.tsx
@@ -1,7 +1,7 @@
 import { Camera, FerrisWheel } from "@tamagui/lucide-icons";
 import AQLink from "components/aqlink";
 import React from "react";
-import { Button, H6, Text, View } from "tamagui";
+import { H6, Text, View } from "tamagui";
 const elems = [
   {
     title: "Stream your camera!",
@@ -11,23 +11,36 @@ const elems = [
   {
     title: "Stream from OBS!",
     Icon: FerrisWheel,
-    to: "Webcam",
+    to: "StreamKey",
   },
 ];
 
 export default function StreamScreen({ route }) {
   return (
-    <View f={1} jc="space-around" ai="center" padding="$3" flexDirection="row">
-      <View f={1} maxWidth={250}>
+    <View f={1} jc="space-around" ai="stretch" padding="$3" flexDirection="row">
+      <View f={1} maxWidth={250} alignItems="stretch" justifyContent="center">
         {elems.map(({ Icon, title, to }, i) => (
           <React.Fragment key={i}>
-            <AQLink to={{ screen: to }} style={{ display: "flex" }}>
-              <Button f={1} padding="$6" backgroundColor="$accentColor">
-                <View f={1} flexDirection="row" ai="center" jc="space-between">
-                  <Icon padding="$5" size={48} marginLeft={-20} />
-                  <Text>{title}</Text>
+            <AQLink
+              to={{ screen: to }}
+              style={{ display: "flex", flex: 1, flexGrow: 0, flexBasis: 75 }}
+            >
+              <View
+                f={1}
+                flexDirection="row"
+                ai="center"
+                jc="space-between"
+                backgroundColor="$accentColor"
+                // padding="$5"
+                borderRadius="$10"
+              >
+                <View padding="$5" paddingRight={0}>
+                  <Icon size={48} />
                 </View>
-              </Button>
+                <Text f={1} textAlign="right" paddingRight="$5">
+                  {title}
+                </Text>
+              </View>
             </AQLink>
             {i < elems.length - 1 && (
               <View jc="center" ai="center">
diff --git a/js/app/src/screens/stream-key.tsx b/js/app/src/screens/stream-key.tsx
new file mode 100644
index 000000000..729bbff43
--- /dev/null
+++ b/js/app/src/screens/stream-key.tsx
@@ -0,0 +1,120 @@
+import { useToastController } from "@tamagui/toast";
+import Loading from "components/loading/loading";
+import {
+  clearStreamKeyRecord,
+  createStreamKeyRecord,
+  selectUserProfile,
+} from "features/bluesky/blueskySlice";
+import { useEffect, useState } from "react";
+import { useAppDispatch, useAppSelector } from "store/hooks";
+import { View, Paragraph, Button } from "tamagui";
+
+const Row = ({ children }: { children: React.ReactNode }) => {
+  return (
+    <View w="100%" f={1} fd="row" padding="$4">
+      {children}
+    </View>
+  );
+};
+
+const Left = ({ children }: { children: React.ReactNode }) => {
+  return (
+    <View f={2} fb={0}>
+      {children}
+    </View>
+  );
+};
+
+const Right = ({ children }: { children: React.ReactNode }) => {
+  return (
+    <View f={6} alignItems="stretch" fb={0}>
+      {children}
+    </View>
+  );
+};
+
+export default function StreamKeyScreen() {
+  const userProfile = useAppSelector(selectUserProfile);
+  const url = useAppSelector((state) => state.aquareum.url);
+
+  if (!userProfile) {
+    return <Loading />;
+  }
+  return (
+    <View f={1} ai="center" jc="center" gap="$4" w="100%" p="$4">
+      <View w="100%" maxWidth={500}>
+        <Row>
+          <Left>
+            <Paragraph>Service</Paragraph>
+          </Left>
+          <Right>
+            <Paragraph>WHIP</Paragraph>
+          </Right>
+        </Row>
+        <Row>
+          <Left>
+            <Paragraph>Server</Paragraph>
+          </Left>
+          <Right>
+            <Paragraph>{url}</Paragraph>
+          </Right>
+        </Row>
+        <Row>
+          <Left>
+            <Paragraph>Bearer Token</Paragraph>
+          </Left>
+          <Right>
+            <StreamKey />
+          </Right>
+        </Row>
+      </View>
+    </View>
+  );
+}
+
+export function StreamKey() {
+  const dispatch = useAppDispatch();
+  const [generating, setGenerating] = useState(false);
+  const newKey = useAppSelector((state) => state.bluesky.newKey);
+  const toast = useToastController();
+  useEffect(() => {
+    if (!newKey) {
+      return;
+    }
+    (async () => {
+      try {
+        await navigator.clipboard.writeText(newKey.privateKey);
+        toast.show("Copied!", {
+          message: "Bearer token copied to clipboard",
+        });
+      } catch (e) {
+        // not allowed. oh well.
+      }
+    })();
+    return () => {
+      dispatch(clearStreamKeyRecord());
+    };
+  }, [newKey]);
+  if (generating) {
+    return <Loading />;
+  }
+  if (newKey) {
+    return <Paragraph fontFamily="$mono">{newKey.privateKey}</Paragraph>;
+  }
+  return (
+    <Button
+      onPress={async () => {
+        try {
+          setGenerating(true);
+          await dispatch(createStreamKeyRecord({ store: false }));
+        } catch (e) {
+          console.error("failed to generate stream key", e);
+        } finally {
+          setGenerating(false);
+        }
+      }}
+    >
+      Generate Stream Key
+    </Button>
+  );
+}
diff --git a/js/app/store/store.tsx b/js/app/store/store.tsx
index f75e3f880..63dbf2b32 100644
--- a/js/app/store/store.tsx
+++ b/js/app/store/store.tsx
@@ -2,6 +2,7 @@ import type { Action, ThunkAction } from "@reduxjs/toolkit";
 import { combineSlices, configureStore } from "@reduxjs/toolkit";
 import { setupListeners } from "@reduxjs/toolkit/query";
 import { aquareumSlice } from "features/aquareum/aquareumSlice";
+import { baseSlice } from "features/base/baseSlice";
 import { blueskySlice } from "features/bluesky/blueskySlice";
 import { platformSlice } from "features/platform/platformSlice";
 import { playerSlice } from "features/player/playerSlice";
@@ -11,6 +12,7 @@ const rootReducer = combineSlices(
   aquareumSlice,
   platformSlice,
   playerSlice,
+  baseSlice,
 );
 
 export type RootState = ReturnType<typeof rootReducer>;
diff --git a/pkg/api/api.go b/pkg/api/api.go
index baa5185d3..754575f98 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -126,6 +126,7 @@ func (a *AquareumAPI) Handler(ctx context.Context) (http.Handler, error) {
 	router.Handler("PATCH", "/api/*resource", apiRouter)
 	router.Handler("DELETE", "/api/*resource", apiRouter)
 	router.GET("/dl/*params", a.HandleAppDownload(ctx))
+	router.POST("/", a.HandleWebRTCIngest(ctx))
 	if a.CLI.FrontendProxy != "" {
 		u, err := url.Parse(a.CLI.FrontendProxy)
 		if err != nil {
@@ -147,6 +148,10 @@ func (a *AquareumAPI) Handler(ctx context.Context) (http.Handler, error) {
 		}
 		router.NotFound = a.FileHandler(ctx, http.FileServer(AppHostingFS{http.FS(files)}))
 	}
+	// needed because the WebRTC handler issues 405s from / otherwise
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		router.NotFound.ServeHTTP(w, r)
+	})
 	handler := sloghttp.Recovery(router)
 	handler = cors.AllowAll().Handler(handler)
 	handler = sloghttp.New(slog.Default())(handler)
diff --git a/pkg/api/playback.go b/pkg/api/playback.go
index 7b1cccbbd..1636037ba 100644
--- a/pkg/api/playback.go
+++ b/pkg/api/playback.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto"
 	"fmt"
 	"io"
 	"net/http"
@@ -14,9 +15,12 @@ import (
 	"aquareum.tv/aquareum/pkg/aqtime"
 	"aquareum.tv/aquareum/pkg/atproto"
 	"aquareum.tv/aquareum/pkg/errors"
+	apierrors "aquareum.tv/aquareum/pkg/errors"
 	"aquareum.tv/aquareum/pkg/log"
 	"aquareum.tv/aquareum/pkg/media"
+	"github.com/decred/dcrd/dcrec/secp256k1"
 	"github.com/julienschmidt/httprouter"
+	"github.com/mr-tron/base58"
 	"github.com/pion/webrtc/v4"
 	"golang.org/x/sync/errgroup"
 )
@@ -161,8 +165,60 @@ func (a *AquareumAPI) HandleWebRTCPlayback(ctx context.Context) httprouter.Handl
 	}
 }
 
+const BEARER_PREFIX = "Bearer "
+const KEY_PREFIX = "0x"
+
 func (a *AquareumAPI) HandleWebRTCIngest(ctx context.Context) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
+		ct := r.Header.Get("Content-Type")
+		if ct != "application/sdp" {
+			errors.WriteHTTPBadRequest(w, "invalid content type", nil)
+			return
+		}
+		auth := r.Header.Get("Authorization")
+		if auth == "" {
+			errors.WriteHTTPUnauthorized(w, "authorization header required", nil)
+			return
+		}
+		if !strings.HasPrefix(auth, BEARER_PREFIX) {
+			errors.WriteHTTPUnauthorized(w, "invalid authorization header (needs Bearer prefix)", nil)
+			return
+		}
+		encoded := auth[len(BEARER_PREFIX):]
+		if len(encoded) < 2 || encoded[0] != 'z' {
+			errors.WriteHTTPUnauthorized(w, "invalid authorization key (not a multibase base58btc string)", nil)
+			return
+		}
+		data, err := base58.Decode(encoded[1:])
+		if err != nil {
+			errors.WriteHTTPUnauthorized(w, "invalid authorization key (not a multibase base58btc string)", nil)
+			return
+		}
+		addrBytes := data[:32]
+		didBytes := data[32:]
+
+		key, _ := secp256k1.PrivKeyFromBytes(addrBytes)
+		if key == nil {
+			errors.WriteHTTPUnauthorized(w, "invalid authorization key (not valid secp256k1)", nil)
+			return
+		}
+		var signer crypto.Signer = key.ToECDSA()
+
+		did := string(didBytes)
+		fmt.Println("did", did)
+
+		mediaSigner, err := media.MakeMediaSigner(ctx, a.CLI, "fixme-media-signer", signer, a.Model)
+		if err != nil {
+			errors.WriteHTTPUnauthorized(w, "invalid authorization key (not valid secp256k1)", err)
+			return
+		}
+
+		_, err = atproto.SyncBlueskyRepo(ctx, did, a.Model)
+		if err != nil {
+			apierrors.WriteHTTPInternalServerError(w, "could not resolve aquareum key", err)
+			return
+		}
+
 		// user := p.ByName("user")
 		// if user == "" {
 		// 	errors.WriteHTTPBadRequest(w, "user required", nil)
@@ -179,7 +235,7 @@ func (a *AquareumAPI) HandleWebRTCIngest(ctx context.Context) httprouter.Handle
 			return
 		}
 		offer := webrtc.SessionDescription{Type: webrtc.SDPTypeOffer, SDP: string(body)}
-		answer, err := a.MediaManager.WebRTCIngest(ctx, &offer, a.MediaSigner)
+		answer, err := a.MediaManager.WebRTCIngest(ctx, &offer, mediaSigner)
 		if err != nil {
 			errors.WriteHTTPInternalServerError(w, "error playing back", err)
 			return
diff --git a/pkg/atproto/atproto.go b/pkg/atproto/atproto.go
index 03042ba4a..3745f3738 100644
--- a/pkg/atproto/atproto.go
+++ b/pkg/atproto/atproto.go
@@ -4,12 +4,15 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 
 	"aquareum.tv/aquareum/pkg/aqhttp"
+	"aquareum.tv/aquareum/pkg/crypto/aqpub"
 	"aquareum.tv/aquareum/pkg/log"
 	"aquareum.tv/aquareum/pkg/model"
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	atcrypto "github.com/bluesky-social/indigo/atproto/crypto"
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/repo"
@@ -21,7 +24,11 @@ import (
 )
 
 var SyncGetRepo = comatproto.SyncGetRepo
-var AQUAREUM_KEY = "tv.aquareum.key"
+var STREAMPLACE_COLLECTION = "place.stream.key"
+var STREAMPLACE_SIGNING_KEY = "signingKey"
+
+const DID_KEY_PREFIX = "did:key"
+const ADDRESS_KEY_PREFIX = "0x"
 
 // handleLocks provides per-handle synchronization
 var handleLocks = struct {
@@ -51,7 +58,7 @@ func SyncBlueskyRepoCached(ctx context.Context, handle string, mod model.Model)
 		return "", fmt.Errorf("failed to get repo for %s: %w", handle, err)
 	}
 	if repo != nil {
-		return repo.AquareumKey, nil
+		return repo.SigningKey, nil
 	}
 	return SyncBlueskyRepo(ctx, handle, mod)
 }
@@ -115,7 +122,7 @@ func SyncBlueskyRepo(ctx context.Context, handle string, mod model.Model) (strin
 		}
 		if oldRoot.Equals(root) {
 			log.Log(ctx, "no changes to repo", "root", root)
-			return oldRepo.AquareumKey, nil
+			return oldRepo.SigningKey, nil
 		}
 	}
 
@@ -137,7 +144,7 @@ func SyncBlueskyRepo(ctx context.Context, handle string, mod model.Model) (strin
 	processed := 0
 	var key string
 	if oldRepo != nil {
-		key = oldRepo.AquareumKey
+		key = oldRepo.SigningKey
 	}
 	bs = r.Blockstore()
 	cst := util.CborStore(bs)
@@ -157,11 +164,11 @@ func SyncBlueskyRepo(ctx context.Context, handle string, mod model.Model) (strin
 		if !ok {
 			continue
 		}
-		if typ != "app.bsky.feed.post" {
+		if typ != STREAMPLACE_COLLECTION {
 			continue
 		}
 		processed += 1
-		aquareumKeyAny, ok := rec[AQUAREUM_KEY]
+		aquareumKeyAny, ok := rec[STREAMPLACE_SIGNING_KEY]
 		if !ok {
 			continue
 		}
@@ -172,20 +179,43 @@ func SyncBlueskyRepo(ctx context.Context, handle string, mod model.Model) (strin
 		key = aquareumKey
 	}
 	log.Log(ctx, "processed new posts", "postCount", processed)
+
+	var aqk aqpub.Pub
+	if strings.HasPrefix(key, DID_KEY_PREFIX) {
+		pubKey, err := atcrypto.ParsePublicDIDKey(key)
+		if err != nil {
+			return "", fmt.Errorf("failed to parse multibase key %s: %w", key, err)
+		}
+		aqk, err = aqpub.FromBytes(pubKey.UncompressedBytes())
+		if err != nil {
+			return "", fmt.Errorf("failed to parse public key for %s: %w", handle, err)
+		}
+	} else if strings.HasPrefix(key, ADDRESS_KEY_PREFIX) {
+		aqk, err = aqpub.FromHexString(key)
+		if err != nil {
+			return "", fmt.Errorf("failed to parse public key for %s: %w", handle, err)
+		}
+	} else {
+		return "", fmt.Errorf("invalid key format for %s: %s", handle, key)
+	}
+	if err != nil {
+		return "", fmt.Errorf("failed to parse public key for %s: %w", handle, err)
+	}
+	addr := aqk.String()
 	newRepo := model.Repo{
-		DID:         ident.DID.String(),
-		PDS:         ident.PDSEndpoint(),
-		Version:     sc.Rev,
-		AquareumKey: key,
-		RootCID:     root.String(),
-		Handle:      handle,
+		DID:        ident.DID.String(),
+		PDS:        ident.PDSEndpoint(),
+		Version:    sc.Rev,
+		SigningKey: addr,
+		RootCID:    root.String(),
+		Handle:     handle,
 	}
 	err = mod.UpdateRepo(&newRepo)
 	if err != nil {
 		return "", fmt.Errorf("failed to update DID record for %s: %w", sc.Did, err)
 	}
 
-	return key, nil
+	return addr, nil
 }
 
 var ResolveIdent = resolveIdent
diff --git a/pkg/atproto/atproto_test.go b/pkg/atproto/atproto_test.go
index 1c1ee0ebc..abb87e9b0 100644
--- a/pkg/atproto/atproto_test.go
+++ b/pkg/atproto/atproto_test.go
@@ -16,9 +16,12 @@ import (
 
 func TestKeyResolution(t *testing.T) {
 	// i wrote these tests before i renamed this and i don't wanna re-export, okay?
-	oldAquareumKey := AQUAREUM_KEY
-	defer func() { AQUAREUM_KEY = oldAquareumKey }()
-	AQUAREUM_KEY = "aquareumKey"
+	oldAquareumCollection := STREAMPLACE_COLLECTION
+	oldAquareumKey := STREAMPLACE_SIGNING_KEY
+	defer func() { STREAMPLACE_COLLECTION = oldAquareumCollection }()
+	defer func() { STREAMPLACE_SIGNING_KEY = oldAquareumKey }()
+	STREAMPLACE_COLLECTION = "app.bsky.feed.post"
+	STREAMPLACE_SIGNING_KEY = "aquareumKey"
 
 	dir, err := os.MkdirTemp("", "atproto-test-*")
 	require.NoError(t, err)
diff --git a/pkg/cmd/aquareum.go b/pkg/cmd/aquareum.go
index 4f343975f..ef30d7e10 100644
--- a/pkg/cmd/aquareum.go
+++ b/pkg/cmd/aquareum.go
@@ -118,7 +118,7 @@ func start(build *config.BuildFlags, platformJobs []jobFunc) error {
 	fs.StringVar(&cli.PKCS11KeypairID, "pkcs11-keypair-id", "", "id of signing keypair on PKCS11 token")
 	fs.StringVar(&cli.StreamerName, "streamer-name", "", "name of the person streaming from this aquareum node")
 	fs.StringVar(&cli.FrontendProxy, "dev-frontend-proxy", "", "(FOR DEVELOPMENT ONLY) proxy frontend requests to this address instead of using the bundled frontend")
-	cli.AddressSliceFlag(fs, &cli.AllowedStreams, "allowed-streams", "", "comma-separated list of addresses that this node will replicate")
+	cli.StringSliceFlag(fs, &cli.AllowedStreams, "allowed-streams", "", "comma-separated list of addresses or atproto DIDs that this node will replicate")
 	cli.StringSliceFlag(fs, &cli.Peers, "peers", "", "other aquareum nodes to replicate to")
 	cli.DebugFlag(fs, &cli.Debug, "debug", "", "modified log verbosity for specific functions or files in form func=ToHLS:3,file=gstreamer.go:4")
 	fs.BoolVar(&cli.TestStream, "test-stream", false, "run a built-in test stream on boot")
@@ -250,11 +250,11 @@ func start(build *config.BuildFlags, platformJobs []jobFunc) error {
 		signer = hwsigner
 	}
 	var rep replication.Replicator = &boring.BoringReplicator{Peers: cli.Peers}
-	mm, err := media.MakeMediaManager(ctx, &cli, signer, rep)
+	mod, err := model.MakeDB(cli.DBPath)
 	if err != nil {
 		return err
 	}
-	mod, err := model.MakeDB(cli.DBPath)
+	mm, err := media.MakeMediaManager(ctx, &cli, signer, rep, mod)
 	if err != nil {
 		return err
 	}
@@ -403,7 +403,7 @@ func start(build *config.BuildFlags, platformJobs []jobFunc) error {
 		if err != nil {
 			return err
 		}
-		cli.AllowedStreams = append(cli.AllowedStreams, testMediaSigner.Pub)
+		cli.AllowedStreams = append(cli.AllowedStreams, testMediaSigner.Pub.String())
 		a.Aliases["self-test"] = testMediaSigner.Pub.String()
 		group.Go(func() error {
 			return mm.TestSource(ctx, testMediaSigner)
diff --git a/pkg/config/config.go b/pkg/config/config.go
index ef8f60146..5127c32c0 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -72,7 +72,7 @@ type CLI struct {
 	PKCS11KeypairID        string
 	StreamerName           string
 	Debug                  map[string]map[string]int
-	AllowedStreams         []aqpub.Pub
+	AllowedStreams         []string
 	Peers                  []string
 	TestStream             bool
 	FrontendProxy          string
diff --git a/pkg/crypto/aqpub/aqpub.go b/pkg/crypto/aqpub/aqpub.go
index f40fe9783..f018d3078 100644
--- a/pkg/crypto/aqpub/aqpub.go
+++ b/pkg/crypto/aqpub/aqpub.go
@@ -34,6 +34,15 @@ func FromPublicKey(key *ecdsa.PublicKey) (Pub, error) {
 	return &pub{addr}, nil
 }
 
+func FromBytes(bs []byte) (Pub, error) {
+	pubkey, err := secp256k1.ParsePubKey(bs)
+	if err != nil {
+		return nil, err
+	}
+	addr := crypto.PubkeyToAddress(*pubkey.ToECDSA())
+	return &pub{addr}, nil
+}
+
 func FromPoints(x, y *big.Int) (Pub, error) {
 	key := ecdsa.PublicKey{Curve: secp256k1.S256(), X: x, Y: y}
 	return FromPublicKey(&key)
diff --git a/pkg/media/media.go b/pkg/media/media.go
index 44da35d92..3998ceddd 100644
--- a/pkg/media/media.go
+++ b/pkg/media/media.go
@@ -42,6 +42,7 @@ type MediaManager struct {
 	httpPipesMutex      sync.Mutex
 	newSegmentSubs      []chan *NewSegmentNotification
 	newSegmentSubsMutex sync.RWMutex
+	model               model.Model
 }
 
 type NewSegmentNotification struct {
@@ -55,7 +56,7 @@ func RunSelfTest(ctx context.Context) error {
 	return SelfTest(ctx)
 }
 
-func MakeMediaManager(ctx context.Context, cli *config.CLI, signer crypto.Signer, rep replication.Replicator) (*MediaManager, error) {
+func MakeMediaManager(ctx context.Context, cli *config.CLI, signer crypto.Signer, rep replication.Replicator, mod model.Model) (*MediaManager, error) {
 	gst.Init(nil)
 	err := SelfTest(ctx)
 	if err != nil {
@@ -67,6 +68,7 @@ func MakeMediaManager(ctx context.Context, cli *config.CLI, signer crypto.Signer
 		replicator: rep,
 		hlsRunning: map[string]*M3U8{},
 		httpPipes:  map[string]io.Writer{},
+		model:      mod,
 	}, nil
 }
 
@@ -330,9 +332,20 @@ func (mm *MediaManager) ValidateMP4(ctx context.Context, input io.Reader) error
 	if err != nil {
 		return err
 	}
+	var repo *model.Repo
+	if mm.model != nil {
+		repo, err = mm.model.GetRepoBySigningKey(pub.String())
+		if err != nil {
+			return err
+		}
+	}
 	found := false
 	for _, a := range mm.cli.AllowedStreams {
-		if a.Equals(pub) {
+		if a == pub.String() {
+			found = true
+			break
+		}
+		if repo != nil && repo.DID == a {
 			found = true
 			break
 		}
diff --git a/pkg/media/media_signer.go b/pkg/media/media_signer.go
index dad93dc27..e08c8f717 100644
--- a/pkg/media/media_signer.go
+++ b/pkg/media/media_signer.go
@@ -65,17 +65,6 @@ func MakeMediaSigner(ctx context.Context, cli *config.CLI, streamer string, sign
 }
 
 func (ms *MediaSigner) SignMP4(ctx context.Context, input io.ReadSeeker, start int64) ([]byte, error) {
-	ident, err := ms.Model.GetIdentity(ms.Pub.String())
-	if err != nil {
-		return nil, err
-	}
-	if ident.Handle == "" {
-		return nil, fmt.Errorf("no handle set for streamer %s", ms.Pub.String())
-	}
-	creator := []string{ident.Handle}
-	if ident.DID != "" {
-		creator = append(creator, ident.DID)
-	}
 	title := "livestream"
 	mani := obj{
 		"title": fmt.Sprintf("Livestream Segment at %s", aqtime.FromMillis(start)),
@@ -95,7 +84,7 @@ func (ms *MediaSigner) SignMP4(ctx context.Context, input io.ReadSeeker, start i
 					"@context": obj{
 						"dc": "http://purl.org/dc/elements/1.1/",
 					},
-					"dc:creator": creator,
+					"dc:creator": ms.StreamerName,
 					"dc:title":   []string{title},
 					"dc:date":    []string{aqtime.FromMillis(start).String()},
 				},
diff --git a/pkg/media/media_test.go b/pkg/media/media_test.go
index 0b86edda7..662d566d0 100644
--- a/pkg/media/media_test.go
+++ b/pkg/media/media_test.go
@@ -12,7 +12,6 @@ import (
 	"aquareum.tv/aquareum/pkg/crypto/aqpub"
 	"aquareum.tv/aquareum/pkg/crypto/signers/eip712/eip712test"
 	_ "aquareum.tv/aquareum/pkg/media/mediatesting"
-	"aquareum.tv/aquareum/pkg/model"
 	"aquareum.tv/aquareum/pkg/replication/boring"
 	"git.aquareum.tv/aquareum-tv/c2pa-go/pkg/c2pa"
 	"github.com/stretchr/testify/require"
@@ -33,11 +32,11 @@ func getStaticTestMediaManager(t *testing.T) (*MediaManager, *MediaSigner) {
 	}
 	cli := ct.CLI(t, &config.CLI{
 		TAURL:          "http://timestamp.digicert.com",
-		AllowedStreams: []aqpub.Pub{pub},
+		AllowedStreams: []string{pub.String()},
 	})
-	mm, err := MakeMediaManager(context.Background(), cli, signer, &boring.BoringReplicator{})
+	mm, err := MakeMediaManager(context.Background(), cli, signer, &boring.BoringReplicator{}, nil)
 	require.NoError(t, err)
-	ms, err := MakeMediaSigner(context.Background(), cli, "test-person", signer, &model.DBModel{})
+	ms, err := MakeMediaSigner(context.Background(), cli, "test-person", signer, nil)
 	return mm, ms
 }
 
diff --git a/pkg/model/model.go b/pkg/model/model.go
index 742d05d96..a3f194f2c 100644
--- a/pkg/model/model.go
+++ b/pkg/model/model.go
@@ -39,7 +39,7 @@ type Model interface {
 
 	GetRepo(did string) (*Repo, error)
 	GetRepoByHandle(handle string) (*Repo, error)
-	GetRepoByAquareumKey(aquareumKey string) (*Repo, error)
+	GetRepoBySigningKey(signingKey string) (*Repo, error)
 	UpdateRepo(repo *Repo) error
 
 	GetLiveUsers() ([]Segment, error)
diff --git a/pkg/model/repo.go b/pkg/model/repo.go
index 6d2a89467..2477e1d25 100644
--- a/pkg/model/repo.go
+++ b/pkg/model/repo.go
@@ -7,12 +7,12 @@ import (
 )
 
 type Repo struct {
-	DID         string `gorm:"primaryKey;column:did" json:"did"`
-	Handle      string `gorm:"index" json:"handle"`
-	PDS         string `json:"pds"`
-	Version     string `json:"version"`
-	AquareumKey string `gorm:"index" json:"aquareumKey"`
-	RootCID     string `json:"rootCid"`
+	DID        string `gorm:"primaryKey;column:did" json:"did"`
+	Handle     string `gorm:"index" json:"handle"`
+	PDS        string `json:"pds"`
+	Version    string `json:"version"`
+	SigningKey string `gorm:"index" json:"signingKey"`
+	RootCID    string `json:"rootCid"`
 }
 
 func (Repo) TableName() string {
@@ -43,9 +43,9 @@ func (m *DBModel) GetRepoByHandle(handle string) (*Repo, error) {
 	return &repoModel, nil
 }
 
-func (m *DBModel) GetRepoByAquareumKey(aquareumKey string) (*Repo, error) {
+func (m *DBModel) GetRepoBySigningKey(signingKey string) (*Repo, error) {
 	var repoModel Repo
-	res := m.DB.Where("aquareum_key = ?", aquareumKey).First(&repoModel)
+	res := m.DB.Where("signing_key = ?", signingKey).First(&repoModel)
 	if errors.Is(res.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
 	}
diff --git a/pkg/model/segment.go b/pkg/model/segment.go
index d9404dd1a..87ce00f0b 100644
--- a/pkg/model/segment.go
+++ b/pkg/model/segment.go
@@ -11,7 +11,7 @@ type Segment struct {
 	User      string    `json:"user"      gorm:"index:latest_segments"`
 	StartTime time.Time `json:"startTime" gorm:"index:latest_segments"`
 	Title     string    `json:"title"`
-	Repo      *Repo     `json:"repo,omitempty" gorm:"foreignKey:User;references:AquareumKey"`
+	Repo      *Repo     `json:"repo,omitempty" gorm:"foreignKey:User;references:SigningKey"`
 }
 
 func (m *DBModel) CreateSegment(seg *Segment) error {
diff --git a/yarn.lock b/yarn.lock
index 25179629e..b356d3ee6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -203,6 +203,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@atproto/crypto@npm:^0.4.2":
+  version: 0.4.2
+  resolution: "@atproto/crypto@npm:0.4.2"
+  dependencies:
+    "@noble/curves": "npm:^1.1.0"
+    "@noble/hashes": "npm:^1.3.1"
+    uint8arrays: "npm:3.0.0"
+  checksum: 10/2042828555d701c1f19b860502590357356109886c9f1117117922658a521e40161c25aa215853f49f260eda7f82a5b6858b7e260c2e05acbfcb2d9f52dd7bd8
+  languageName: node
+  linkType: hard
+
 "@atproto/did@npm:0.1.3":
   version: 0.1.3
   resolution: "@atproto/did@npm:0.1.3"
@@ -5555,6 +5566,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@noble/curves@npm:^1.1.0":
+  version: 1.7.0
+  resolution: "@noble/curves@npm:1.7.0"
+  dependencies:
+    "@noble/hashes": "npm:1.6.0"
+  checksum: 10/2a11ef4895907d0b241bd3b72f9e6ebe56f0e705949bfd5efe003f25233549f620d287550df2d24ad56a1f953b82ec5f7cf4bd7cb78b1b2e76eb6dd516d44cf8
+  languageName: node
+  linkType: hard
+
 "@noble/hashes@npm:1.4.0, @noble/hashes@npm:^1.3.1, @noble/hashes@npm:^1.4.0, @noble/hashes@npm:~1.4.0":
   version: 1.4.0
   resolution: "@noble/hashes@npm:1.4.0"
@@ -5569,6 +5589,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@noble/hashes@npm:1.6.0":
+  version: 1.6.0
+  resolution: "@noble/hashes@npm:1.6.0"
+  checksum: 10/b44b043b02adbecd33596adeed97d9f9864c24a2410f7ac3b847986c2ecf1f6f0df76024b3f1b14d6ea954932960d88898fe551fb9d39844a8b870e9f9044ea1
+  languageName: node
+  linkType: hard
+
 "@nodelib/fs.scandir@npm:2.1.5":
   version: 2.1.5
   resolution: "@nodelib/fs.scandir@npm:2.1.5"
@@ -11282,6 +11309,7 @@ __metadata:
   dependencies:
     "@aquareum/atproto-oauth-client-react-native": "npm:^0.0.1"
     "@atproto-labs/pipe": "npm:^0.1.0"
+    "@atproto/crypto": "npm:^0.4.2"
     "@atproto/jwk-jose": "npm:^0.1.2"
     "@atproto/oauth-client": "npm:^0.3.1"
     "@babel/core": "npm:^7.26.0"
@@ -11333,6 +11361,7 @@ __metadata:
     expo-web-browser: "npm:^14.0.1"
     hls.js: "npm:^1.5.17"
     jose: "npm:^5.9.6"
+    multiformats: "npm:^13.3.1"
     react: "npm:18.3.1"
     react-dom: "npm:18.3.1"
     react-native: "npm:0.76.2"
@@ -21222,6 +21251,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"multiformats@npm:^13.3.1":
+  version: 13.3.1
+  resolution: "multiformats@npm:13.3.1"
+  checksum: 10/2e529613d457590dffe212a658546f313c7c7296d240d952d2baee7ce0abb227116d784f05cf4d238ef0db7d72ad2c3d04ea3c6b9bfd20db805a092024ce8d7e
+  languageName: node
+  linkType: hard
+
 "multiformats@npm:^9.4.2, multiformats@npm:^9.9.0":
   version: 9.9.0
   resolution: "multiformats@npm:9.9.0"