Identity that is bigger than a login button

LinkKeys is an open protocol for proving identity claims across the whole internet. Instead of asking every application to trust one central account provider, it creates the standard for every app to trust you based on who owns the domain, like catalystlinkkeys.com for instance.

The short techy version

1. A domain publishes its keys. A LinkKeys domain advertises cryptographic fingerprints through DNS and exposes protocol endpoints.
2. You sign in to an app. When a user logs into any app, it has the domain do the login, not the app, and the app gets a signed result that can't be faked or reused with other apps.
3. The domain signs claims. A claim connects a LinkKeys account to a value. It could be your handle, your email, or if you're over 21. Those claims can be validated by other domains like a trusted third party or a government if you allow it.
4. An application asks for exactly what it needs. The request identifies what app is asking, what they want, what's required or not. Nobody can fake being a big name app.
5. You decide what to give. You only need to tell us once, and we won't ask again until it changes (though you can change your mind later). Don't like that they're asking for your address for a recipe app? Deny it. Is it required? Just cancel the request. They never receive anything.
6. The result can only go to the app. No other app can ask for the info. What they do with it after nobody can control, but we can make sure nobody else can get it in the middle.

Domains are the trust roots

When you have to validate someone's ID are you trusting them, or the issuer of the ID? Some combination? Do you trust handing your own ID to an employer more than a random person on the street? Both sides matter in trust, and where matters, too.

Domains already let us shop, bank, and more. Before, you could choose to trust the domain you're buying from and hope they didn't mess up in the future. Now, you can choose to trust the domain you're coming from, and hold them accountable. LinkKeys adds a publicly provable set of tools to what used to be a black box. Did that forum have a data breach? Well, they certainly didn't get your login info now.

That does not make every claim universally trustworthy. It makes the issuer and proof explicit, so an application can apply its own policy: trust a home domain for a handle, require a verified signature for an email, or accept an attestation only from a known issuer.

What that means in plain language is that LinkKeys doesn't solve trust, but it does give you tools to choose who and what you trust based on who is making the claims and who said they backed it up.

Claims, not a giant profile

Imagine that instead of handing over your driver's license, you just handed over individual pieces of info the requester needed, like your name, or if you're over 21 or not.

LinkKeys models identity as individual claims. Applications request claim types; users authorize releases; domains define how claims may be set, verified, signed, attested, or withheld. This makes data minimization a normal protocol operation instead of a promise hidden in a privacy policy.

The important part is that LinkKeys makes that easy for everyone, not just security experts, so everyone benefits.

More than public web applications

Not everything runs in a domain, and LinkKeys handles that too.

The protocol also supports DNS-less local relying parties. A desktop, LAN, or self-hosted application can present a signed key descriptor, be reviewed by the domain, and receive an encrypted callback whose claim ticket can only be redeemed by that app's key.

Putting it plainly, you can trust an app the first time you log into it as well, even if it's not at a domain.

Open implementation

LinkKeys is developed in the open. Read the source and protocol documentation, or see our practical docs for using this domain.