Identity and trust

Every flock has a secp256k1 key pair. The private key signs observations, corrections, deletions, and metadata. The public key is the stable identity of the flock; display names are just labels.

Print your public key with:

birdd --config birdd.toml identity

When a standalone node opens without an existing key file, it creates one and uses mode 0600 on Unix. NixOS deployments require the configured key to exist before the service starts.

Important

Keep the private key secret and backed up. birdd does not currently provide key rotation or identity recovery. Starting with a new key creates a different flock identity.

Metadata

Flock metadata associates the public key with the configured display name and extension capabilities. init creates the first metadata event. Publish a new metadata event after changing those values:

birdd --config birdd.toml metadata
birdd --config birdd.toml sync

Direct trust

Trust is local policy stored in your node’s database. Verify a public key with the other operator before trusting it:

birdd --config birdd.toml trust \
  <public-key> "Cerulean City Birders"

The supplied name is your local label for that key. It does not need to match the flock’s self-published metadata.

Check a relationship with:

birdd --config birdd.toml trust-status <public-key>

Only trusted grants direct trust behavior. There is currently no supported CLI workflow to revoke trust.

Trust and restricted-audience authorization are separate. Direct trust controls which remote observations appear in user-facing Signal queries and which flocks may fetch media. allowed_senders controls who may send into a restricted audience, while recipients controls who receives it.