← All Talks
Lightning Talk Community

How to use Bluesky to easily and securely preview a software product to users.

Tim Burks · @timburks.me
Sunday, March 29, 2026
4:20 PM – 4:30 PM PT
Great Hall South
Available in-person & via livestream — Stream 1 (Great Hall South)

ATProto is a great way to manage identity! One of my favorite things about it is that it's vendor-neutral. I'll describe how I used ATProto to build self-service licensing and analytics for a software beta with no third-party dependencies.

So I'm Tim. Thanks for being here. This is my second Atmosphere. And I just drove up from Northern California. It's been great. Everybody, including the organizers has really been fantastic. This is a short presentation of a hack. I thought you might be interested in it. And maybe it would trigger some ideas for things that you might want to do with it too. So I'm a software developer. I recently left a corporate job to make something new. It's a lot to talk about. So first I'm gonna focus on a kind of a key problem that I had, which is how can I get feedback on early versions of my work.

You might have heard of products that help with this. I've shown a couple on the slide. Oh, I'm not showing. Let's uh go to your send and display. I thought that was just a cool graphic. Yeah, we tested earlier and it worked. Oh here, yeah. Um oh I probably need to mirror my screens. Yeah.

Yeah. Does that look better? Okay, okay, thanks. Um, yeah, anyway, that was my title screen. So I'm a software developer. Um, I've actually spent most of my time coding for the last two years and haven't really talked to people, so I'm a little awkward. Um, but uh I was talking about wanting ways to get feedback on my work, and there are these products that my friends have told me about. Uh configcat, launch darkly, and I guess post hog. And these are all fine, but I'm like just one person. I'm just a person with a laptop, and to me they seemed like too much.

Um you might ask, why don't I just open source it? And I've actually done a lot of open source over the years. Um, and as good as it is, it also has some downsides. I mean, kind of the obvious thing is you might your code might become used by one of your rivals. It might be something that they or their training, uh their coding assistants use. But really, kind of more significantly is that you might commit too soon to a set of features that you regret later. Um, and even worse, you might unexpected c unexpectedly become someone's critical dependency.

And that sounds far-fetched, but it actually happened to me. Um I was an engineer at Google and I had a project, and uh kind of unknown to me, it became useful to Kubernetes. And uh before I knew it, it was a critical dependency of KubeCudd, the Kubernetes CLI. And um I wasn't on the Kubernetes team, and as I moved around in Google, none of my managers appreciated me spending any time taking care of this project. So it just became a tax on me, like a lot of open source projects do. So what do you want to do or do I want to do instead?

I'd like to have a way to release early binaries. Uh, and you know, this is independent of what I do eventually, but in the beginning, I'd like to just give people binaries that they can easily install, but control who can use them so that I can um get feedback both directly and through analytics on how that's been going. And the way that I do this is that I just my this is a server side component, so I just publish Docker binaries and I make all my builds require a license key, which is just a JOT, and we all know about JOHS.

The JOT identifies the user and says they have a license to use this, and then I add atproto sign in to my website. And um anyone can log into my project website with their Bluesky or whatever atproto ID and mint their own license key. But in order to decide who can mint the license key, now this is the hack, instead of keeping a list, I just say that whoever my project account follows can mint a license. So if agent IO follows you, you're in the beta. So I really like this because it's so simple.

And because I'm using atproto identities, no, like I talk to enterprise companies that have their own like login with this or that. None of them can be mad that I'm using one of their competitors to log in to my website, so I'm neutral. And then I didn't even add a lexicon. It was just so easy. I just have a dedicated account for this, and whoever it follows is in my beta. And then I get this thing that my friend Marsh calls social proof or social unproof if I'm not having users. Basically anyone can see who my users are.

So they can see who else is interested in the product. And so that means it might not be right for you. So if you don't like exposing that, you might just want to keep a private list. And like anything, it's breakable. So if you're you know enough of a hacker to break my licenses, um, okay. Um then people need atproto accounts. And if uh people interested in my project don't have one, they have to get an app proto account, which is not a problem to any of us, right? So that's my story. Um this is just a list of things that I like to talk about or I'm interested in hearing about.

So if you see me around and uh just want to say hi, talk about any of those things or anything that's interesting to you, that's cool. We don't have much time left, but I'll be here late today. And I also um how many minutes do I have left? Give me a budget. You got time. Okay, I'm gonna take maybe five minutes. This is what I'm building. This is what I call Io. IO is a network proxy. Um I'm gonna disconnect from it from a second. So it's actually running on a droplet on DigitalOcean, and I can SSH to it, and when I do, I get this terminal UI, and I can use the terminal UI to see all the API traffic that I.

Well, here's my subscribe repos traffic. Um these are calls to get like lists of repos, and I can kind of drill into this and I can see the request. This is the headers and response headers, the request and response headers for this, and I can see this is for debugging, I can see the request and response bodies, and this is what I'm returning. So that's you know, for observation. Now here I've got an implementation of the statusphere app. And this statusphere app is actually also running on my proxy. So if I go back up, I've got this statusphere.babu.dev.

Um, sign into this statusphere app. This I should probably say is not the original statusphere app. This is one that I modified to take advantage of my proxy. And I'm gonna mention here, I'm gonna use an identity on my new PDS that I'm working on. And you can see it's being developed by my fancy login screen, and my very fancy confirmation screen. And so now I'm in. So my user is just named Alpha User, and I'm gonna set its status to uh what do we like? Well, I like that. So it's a butterfly. So I mean, this is the Statusphere app, we all know this, right?

So I come back and see what's going on in my proxy. So we can look at the PDS, and these are the calls that were made to my PDS. So I can see down here sign in. The original like par request that we could look into that. So this is the PAR request. That's the PAR request message that was sent by my app. That's the request uh that's the response body of the PAR request. Okay. And um all the other traffic. And meanwhile, I can also go over to the Statusphere app and see its traffic, which includes uh let's see the callback and the other messages that it sends.

So oh am I looking at the right one? Okay. So anyway, this is IO. It's a tool for building services and observing them as they run. Um I'm doing a got kind of open beta now, so if you connect with me, I'll give you a license, and I'd love to hear what you think. Thanks. Hey, thank you very much, Tim. We're gonna have a very