# resolve an atproto identity

`handle → DID → PDS endpoint + signing key`.

```zig
const std = @import("std");
const zat = @import("zat");

pub fn main(init: std.process.Init) !void {
    const io = init.io;
    const allocator = init.gpa;

    // handle → DID (HTTP /.well-known, then DNS TXT fallback)
    var handle_resolver = zat.HandleResolver.init(io, allocator);
    defer handle_resolver.deinit();
    const did_string = try handle_resolver.resolve(zat.Handle.parse("bsky.app").?);
    defer allocator.free(did_string);

    // DID → DID document (plc.directory for did:plc, the domain for did:web)
    var did_resolver = zat.DidResolver.init(io, allocator);
    defer did_resolver.deinit();
    var doc = try did_resolver.resolve(zat.Did.parse(did_string).?);
    defer doc.deinit();

    // pulled from the fetched DID document — a malformed doc has neither
    const endpoint = doc.pdsEndpoint() orelse return error.NoPdsEndpoint;
    const key = doc.signingKey() orelse return error.NoSigningKey;
    std.debug.print("pds endpoint: {s}\n", .{endpoint});
    std.debug.print("signing key:  {s}\n", .{key.public_key_multibase});
}
```

```
pds endpoint: https://puffball.us-east.host.bsky.network
signing key:  zQ3shQo6TF2moaqMTrUZEM1jeuYRQXeHEx4evX9751y2qPqRA
```

This is `examples/02_resolve_identity.zig` verbatim — copy it and `zig build example-resolve-identity`.

The DID is the identity; the handle and PDS are mutable aliases that float above it, which is what lets an account migrate servers without breaking. Resolution is bidirectional: a handle claims a DID, but the DID document has to claim the handle back through `alsoKnownAs`, or the binding is forgeable. The signing key is the reason the whole chain matters — it's what lets you verify a repo's commits yourself, without trusting the PDS that serves them.

**See also:** the [handle](https://atproto.com/specs/handle) and [DID](https://atproto.com/specs/did) specs; Indigo's [`identity`](https://github.com/bluesky-social/indigo/tree/main/atproto/identity) package. Clients resolve this chain before reading or writing on someone's behalf.

<details>
<summary>wiring zat into your own <code>build.zig</code></summary>

```zig
const zat = b.dependency("zat", .{}).module("zat");
exe.root_module.addImport("zat", zat);
```

after `zig fetch --save https://tangled.org/zat.dev/zat/archive/main`.
</details>