Fedify: an ActivityPub server framework's avatar

Fedify: an ActivityPub server framework

@fedify@hollo.social · 9 following · 788 followers

:fedify: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

🎉 Excited to announce that is now on Open Collective! Support the project's development starting at:

  • Backer (from $5/mo)
  • Supporter (from $25/mo)
  • Sponsor (from $100/mo)
  • Corporate Sponsor (from $500/mo)
  • Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

:fedify:

Fedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.
ALT text detailsFedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.
Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

Fedify is an server framework in & . It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

If you're curious, take a look at the website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

もちもちずきん :teto_zuho: 🍆's avatar
もちもちずきん :teto_zuho: 🍆

@Yohei_Zuho@mstdn.y-zu.org

技術書典オンラインが始まったけど、Fedify本みんな買っていってる

Fediverse Linux Users Group's avatar
Fediverse Linux Users Group

@fedilug@msky.ospn.jp

本日はオープンソースカンファレンス名古屋( )当日です!
吹上駅から徒歩5分ほどの中小企業振興会館、第にファッション展示場で
はブース出展、セミナーでのLT大会を開催予定です!
ステッカー、同人誌用意してお待ちしています!!

Fediverse Linux Users Group's avatar
Fediverse Linux Users Group

@fedilug@msky.ospn.jp · Reply to Fediverse Linux Users Group's post

今週末開催される、 では ブースにて、
・有志8人による執筆のThinking Penguin Magazine Vol.0(500円)
・和条門さん(
@naoki_wjm@k.my-sky.blue )による『さばかんライフ!』(1000円)
・ホンさん(
@hongminhee@hollo.social )による『自分だけのフェディバースのマイクロブログを作ろう!』(500円)
も頒布いたします!
そのほかにもステッカーや各種チラシも扱っておりますので、ぜひ足をお運びください!!

もちもちずきん :teto_zuho: 🍆's avatar
もちもちずきん :teto_zuho: 🍆

@Yohei_Zuho@mstdn.y-zu.org

Fedify本届いた〜

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to just small circles 🕊's post

@smallcircles That's a great point! We definitely want to balance organization benefits with maintainer overhead. The goal is to make our workflow smoother, not more complex. We'll keep the system simple and only add labels that genuinely help contributors find relevant issues. Thanks for the perspective!

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We're planning to reorganize our labels to better reflect 's project structure! 🏷️

Currently using GitHub's default labels, but we want something more tailored to our needs—like component-specific labels (vocab, federation, actor, etc.), runtime tags (Deno/Node/Bun), and compatibility tracking.

The proposal includes hierarchical labeling with categories like:

  • type/ for bug, feature, documentation
  • component/ for different parts of Fedify
  • activitypub/ for interop issues with Mastodon, Misskey, etc.

We'd love your thoughts! What labels would be most helpful for contributors and maintainers?

Check out the full proposal: https://github.com/fedify-dev/fedify/issues/238.

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hackers.pub

2025 오픈소스 컨트리뷰션 아카데미 참여형 멘티를 오늘부터 6월 22일까지 모집한다고 합니다. 저도 Fedify 프로젝트의 멘토로서 참여하고 있으니, 관심 있는 분들은 많은 참여 부탁드립니다!



RE: https://hollo.social/@hongminhee/0196231c-8256-788e-bba1-0d3a9215524f

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Antolius's post

@antolius Great question! For prototyping with custom vocabulary, we're setting up automated PR builds that will solve exactly this use case.

Soon, each pull request will automatically publish versioned builds to JSR and npm. For example, PR would generate releases like:

  • First push: 1.6.0-pr.123.1
  • Second push: 1.6.0-pr.123.2
  • And so on…

This means you can install and test vocabulary extensions before they're merged upstream:

npm install @fedify/fedify@1.6.0-pr.123.1

This approach lets you prototype with your custom object types immediately while contributing back to the community when ready. You can develop against the PR build, and once your vocabulary addition is merged, simply update to the stable release.

The build pipeline isn't quite ready yet, but it's coming soon. In the meantime, forking and building locally is still your best bet for custom vocabulary during prototyping.

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Antolius's post

@antolius Great question! For prototyping with custom vocabulary, we're setting up automated PR builds that will solve exactly this use case.

Soon, each pull request will automatically publish versioned builds to JSR and npm. For example, PR would generate releases like:

  • First push: 1.6.0-pr.123.1
  • Second push: 1.6.0-pr.123.2
  • And so on…

This means you can install and test vocabulary extensions before they're merged upstream:

npm install @fedify/fedify@1.6.0-pr.123.1

This approach lets you prototype with your custom object types immediately while contributing back to the community when ready. You can develop against the PR build, and once your vocabulary addition is merged, simply update to the stable release.

The build pipeline isn't quite ready yet, but it's coming soon. In the meantime, forking and building locally is still your best bet for custom vocabulary during prototyping.

Antolius's avatar
Antolius

@antolius@mastodon.social · Reply to Fedify: an ActivityPub server framework's post

@fedify this sounds reasonable for extending support for 3rd party vocabulary. How do you envision developing 1st party vocab for servers implemented using fedify?

For example, I'm developing a service that needs to introduce some new object types. But I'm nowhere near ready to codify them in a FEP or share them with broader fedify userbase. What would be the best way to continue using fedify in this prototyping phase? (Perhaps building with a fedify fork and merge uspream once server is done?)

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

While 's API provides comprehensive support for and major vendor extensions, its code-generation approach makes runtime extensions challenging. However, the project welcomes contributions to expand the supported types and properties.

Fedify accepts vocabulary contributions when they meet any of these criteria:

  • Documented in FEP (Fediverse Enhancement Proposals) or equivalent specification
  • Already adopted by widely-used implementations like Mastodon or Pleroma
  • Thoroughly discussed within the Fedify community (Discord, Matrix, GitHub Discussions)

Contributing new vocabulary is straightforward. The vocabulary definitions live in YAML files within the fedify/vocab/ directory. To add a new type, create a new .yaml file. To add properties to existing types, extend the properties section in the relevant .yaml file.

This approach ensures Fedify's vocabulary coverage grows with the fediverse ecosystem while maintaining type safety and comprehensive documentation. If you're working with custom ActivityPub extensions, consider contributing them upstream to benefit the entire community.

For detailed guidance on the contribution process, see the Extending the vocabulary section in Fedify's docs.

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We inadvertently published @fedify/fedify 1.6.0 and @fedify/cli 1.6.0 to npm before they were ready for release. (Note: 1.6.0 was not released to JSR.)

Both versions have been deprecated and unpublished. Please avoid using these versions.

Our next minor release will be version 1.6.1, which will include the intended changes and fixes.

We apologize for any inconvenience this may have caused.

ココイ:role_bisyouzyo:'s avatar
ココイ:role_bisyouzyo:

@kokoi@n-kaiwai.work

HolloとかFedifyのお話おもしろかったのだ

우리의 코드를 찾아서 – 2막. 민희님과 Fedify & Hollo 알아보기
https://youtu.be/sqxR8zscSDo?si=nQRxPyV7kjplqy01

Fediverse Linux Users Group's avatar
Fediverse Linux Users Group

@fedilug@msky.ospn.jp

【.​:fedilug:​ 技術書典18に出展します 📚
:fedilug:​ は6月1日に技術書専門イベントである、 の お06 で合同誌『Thinking Penguin Magazine Vol.0』と @hongminhee@hollo.social さん著の『自分だけのフェディバースのマイクロブログを作ろう!』を頒布します!
どちらも500円で購入できます!!ぜひお立ち寄りください!
詳細はこちら :
https://techbookfest.org/organization/7JepZT0g3C6qbddiLmkAwp

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

Had a wonderful time today at our second FediDev KR (@sprints.fedidev.kr) gathering at Turing's Apple (@TuringAppleDev) in !

We spent the day contributing to various open source projects including @fedify, @hollo, and Hackers' Pub. It was fantastic to see the community come together to build and improve tools for the decentralized social web.

Our participants made some great contributions, and you can read all about what we accomplished in today's blog post.

Looking forward to our next sprint!

A hand holding a 3D-printed keychain featuring the Fedify dinosaur mascot logo in blue and white colors. The keychain is packaged in a clear plastic bag with Korean text indicating it's from the FediDev KR Second Sprint on May 24, 2025. The background shows laptops and stickers on a table, suggesting a coding workspace at the sprint event.
ALT text detailsA hand holding a 3D-printed keychain featuring the Fedify dinosaur mascot logo in blue and white colors. The keychain is packaged in a clear plastic bag with Korean text indicating it's from the FediDev KR Second Sprint on May 24, 2025. The background shows laptops and stickers on a table, suggesting a coding workspace at the sprint event.
A bright green poster for FediDev KR #2 sprint event, showing the date 2025-05-24 Sat 13:00–18:00. The poster features Korean text announcing a FediDev KR sprint session, with the Turing's Apple logo and a circular blue logo with wave-like design. The poster is displayed on a TV at the entrance of the venue.
ALT text detailsA bright green poster for FediDev KR #2 sprint event, showing the date 2025-05-24 Sat 13:00–18:00. The poster features Korean text announcing a FediDev KR sprint session, with the Turing's Apple logo and a circular blue logo with wave-like design. The poster is displayed on a TV at the entrance of the venue.
洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hackers.pub

오늘 박현우 님(@lqez)께서 Fedify 로고로 배지를 만들어 와주셨습니다! FediDev KR 두 번째 스프린트 모임 오신 분들께 나눠드리고 있어요.

Fedify 로고 배지
ALT text detailsFedify 로고 배지
洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

I've been thinking about adding a debug dashboard to that shows all activities being sent and received in real-time. This would include filters by activity type, detailed inspection of JSON-LD content, signature verification details, and retry management for failed deliveries.

As a , would you find this useful for troubleshooting federation issues? Any other features that would be helpful in such a debugging tool?

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

Fedifyは新しいパートナーシップの機会を探しています!

:fedify: Fedifyとは?

Fedifyは、ActivityPubベースのフェデレーションサーバーフレームワークで、開発者が分散型ソーシャルネットワークである)にアプリケーションを簡単に統合できるよう支援します。複雑なActivityPubプロトコルの実装を簡素化し、開発時間を大幅に短縮します。MITライセンスの下で提供されるオープンソースプロジェクトです。

💼 Fedifyを活用しているプロジェクト

すでに様々なプロジェクトがFedifyを活用しています:

  • Ghost:数百万人のユーザーを持つプロフェッショナルな出版プラットフォーム(MITライセンスのオープンソース)で、Fedifyの主要スポンサー兼パートナーです。
  • Hollo:個人ユーザー向けの軽量マイクロブログ(オープンソース、AGPL-3.0)
  • Hackers' Pub:ソフトウェアエンジニア向けのフェディバースブログプラットフォーム(オープンソース、AGPL-3.0)
  • Encyclia:ORCID学術記録をActivityPubを通じて提供するブリッジサービス

🚀 Fedifyが提供する価値

  • 開発時間80%削減:複雑なActivityPub実装の代わりに実証済みフレームワークを活用
  • 即時Fediverse互換性:Mastodon、Misskey、Pleroma、Pixelfed、PeerTubeなど様々なFediverseサービスとすぐに互換
  • 専門技術サポート:ActivityPubおよびフェデレーションプロトコルの専門家による直接サポート
  • カスタム開発:お客様の特定要件に合わせた機能開発

🤝 可能な協力モデル

  • カスタムコンサルティングと統合サポート:お客様のプラットフォームへのFedify統合のための専門的支援
  • カスタム機能開発:お客様のプラットフォームに必要な特定機能の開発と実装
  • 長期的な技術パートナーシップ:継続的な開発とメンテナンスのための長期協力関係

🌟 Fedifyとの協力によるメリット

  • 技術的優位性:自社開発と比較して時間とリソースの節約
  • ブランドイメージ:オープンソースエコシステムへの支援を通じた企業イメージの向上
  • 分散型ソーシャルネットワークへの参入:フェディバースエコシステムへの容易な参加
  • 競争優位性:ソーシャル機能による製品競争力の強化

📩 興味をお持ちですか?

ActivityPubの実装をご検討中の方や、Fedifyプロジェクトとの協力にご興味のある方は、ぜひご連絡ください:

お客様の要件と目標に合わせたカスタマイズされた協力の可能性を一緒に探りましょう。

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

Fedify는 새로운 후원 파트너를 찾고 있습니다!

:fedify: Fedify란?

Fedify는 기반 연합형 서버 프레임워크로, 개발자들이 분산형 소셜 네트워크인 ()에 애플리케이션을 쉽게 통합할 수 있도록 돕습니다. 복잡한 ActivityPub 프로토콜 구현을 단순화하여 개발 시간을 크게 단축시킵니다. MIT 라이선스 하에 제공되는 오픈 소스 프로젝트입니다.

💼 Fedify를 활용하는 프로젝트들

다양한 프로젝트들이 이미 Fedify를 활용하고 있습니다:

  • Ghost: 수백만 사용자를 보유한 전문적인 오픈 소스(MIT 라이선스) 퍼블리싱 플랫폼으로, Fedify의 주요 후원사이자 파트너입니다.
  • Hollo: 개인 사용자를 위한 경량 마이크로블로그 (오픈 소스, AGPL-3.0)
  • Hackers' Pub: 소프트웨어 엔지니어를 위한 연합우주 블로그 플랫폼 (오픈 소스, AGPL-3.0)
  • Encyclia: ORCID 학술 기록을 ActivityPub을 통해 제공하는 브리지 서비스

🚀 Fedify가 제공하는 가치

  • 개발 시간 80% 단축: ActivityPub의 복잡한 구현 대신 검증된 프레임워크 활용
  • 즉각적인 연합우주 호환성: Mastodon, Misskey, Pleroma, Pixelfed, PeerTube 등 다양한 연합우주 서비스와 즉시 호환
  • 전문 기술 지원: ActivityPub 및 연합 프로토콜 전문가의 직접 지원
  • 맞춤형 개발: 귀사의 특정 요구사항에 맞는 맞춤형 기능 개발

🤝 가능한 협력 모델

  • 맞춤형 컨설팅 및 통합 지원: 귀사 플랫폼에 통합을 위한 전문적 지원
  • 맞춤형 기능 개발 의뢰: 귀사에 필요한 특정 기능의 개발 및 구현
  • 장기적인 기술 파트너십: 지속적인 개발 및 유지보수를 위한 장기 협력 관계

🌟 Fedify와 협력했을 때의 이점

  • 기술적 이점: 자체 구현 대비 시간과 리소스 절약
  • 브랜드 이미지: 오픈 소스 생태계 지원을 통한 기업 이미지 강화
  • 분산형 소셜 네트워크 진입: 연합우주 생태계에 쉽게 참여
  • 경쟁 우위: 소셜 기능을 통한 제품 경쟁력 강화

📩 관심이 있으신가요?

ActivityPub 구현을 고려 중이시거나, Fedify 프로젝트와 협력하고 싶으시다면 연락 주세요:

귀사의 요구사항과 목표에 맞는 맞춤형 협력 방안을 함께 모색하겠습니다.

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

Fedify is looking for new partnership opportunities!

:fedify: What is Fedify?

is an -based federated server framework that helps developers easily integrate their applications with the , a decentralized social network. It simplifies the complex implementation of the ActivityPub protocol, significantly reducing development time. Fedify is an open-source project available under the MIT license.

💼 Projects using Fedify

Various projects are already leveraging Fedify:

  • Ghost: A professional publishing platform with millions of users, open source under MIT license, and a major sponsor and partner of Fedify.
  • Hollo: A lightweight microblogging platform for individual users (open source, AGPL-3.0)
  • Hackers' Pub: A fediverse blogging platform for software engineers (open source, AGPL-3.0)
  • Encyclia: A bridge service that makes ORCID academic records available via ActivityPub

🚀 Value provided by Fedify

  • 80% development time reduction: Utilize a proven framework instead of complex ActivityPub implementation
  • Immediate fediverse compatibility: Instant compatibility with various fediverse services including Mastodon, Misskey, Pleroma, Pixelfed, PeerTube, etc.
  • Expert technical support: Direct support from ActivityPub and Federation protocol experts
  • Custom development: Tailored feature development to meet your specific requirements

🤝 Potential collaboration models

  • Custom consulting and integration support: Professional assistance for integrating Fedify into your platform
  • Custom feature development: Development and implementation of specific features needed for your platform
  • Long-term technical partnership: Long-term collaboration for continuous development and maintenance

🌟 Benefits of collaborating with Fedify

  • Technical advantage: Save time and resources compared to in-house implementation
  • Brand image: Enhance corporate image through support of the open-source ecosystem
  • Entry to decentralized social networks: Easily participate in the fediverse ecosystem
  • Competitive edge: Strengthen product competitiveness through social features

📩 Interested?

If you're considering implementing ActivityPub or wish to collaborate with the Fedify project, please get in touch:

We're excited to explore customized collaboration opportunities that align with your requirements and goals.

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social · Reply to 洪 民憙 (Hong Minhee)'s post

For those interested in supporting 's development, we do have an Open Collective page where community is welcome.

Even small contributions help sustain development and show there's interest in open source tools. Thanks to our existing sponsors who've already been helping move the project forward!

The goal remains the same: make building federated applications more accessible to developers so the can continue to grow and thrive.

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

Just received word that @fedify wasn't selected for @nlnet's Open Call this round. While disappointing, I understand the competition was fierce with many worthy projects seeking limited funding.

The journey continues though— development will move forward at its own pace. Thanks to everyone who's shown interest and support for this project so far. Building tools for the remains important work, and I'm committed to seeing it through.

If you know of other funding opportunities that might be a good fit for open source tools, I'm all ears.

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

Good news! We've officially added support to the roadmap. We've created a detailed issue to track our implementation plan: https://github.com/fedify-dev/fedify/issues/233.

The effort will be tackled in phases, including compatibility assessment, core adaptations for Workers' environment, KV store and message queue implementations, and finally integration with Cloudflare's ecosystem. This will be a substantial project that we'll break down into several sub-issues.

If you're interested in contributing to any specific aspect of Workers support, please comment on the main issue to coordinate efforts.

もちもちずきん :teto_zuho: 🍆's avatar
もちもちずきん :teto_zuho: 🍆

@Yohei_Zuho@mstdn.y-zu.org

Fedify本、TPM入稿だん!

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social · Reply to 洪 民憙 (Hong Minhee)'s post

Okay, I've just deployed a bleeding edge , which implements both RFC 9421 and double-knocking, to Hackers' Pub. If you'd like to test your implementations against a real server, please give it a try! (If you want to create an account, let me know—I can invite you.)

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

Looking for implementations with support! 🔍

As mentioned in the Fedify announcement below, I've implemented RFC 9421 (HTTP Message Signatures) and need to verify its interoperability with other ActivityPub implementations.

The challenge is that most major ActivityPub projects don't seem to have full RFC 9421 implementations in production yet. If you're working on an ActivityPub project that:

  • has implemented RFC 9421 (even in a development branch)
  • is currently implementing it
  • has plans to implement it soon

Please reach out! I'd love to collaborate on interoperability testing to ensure our implementations work properly with each other before merging this into 's main branch.

Any leads or connections would be greatly appreciated! 🙏

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We're excited to announce that we've implemented RFC 9421 (HTTP Message Signatures) in , complete with our double-knocking mechanism to maintain backward compatibility with the draft cavage version.

This implementation includes both signature generation and verification, meaning is used when both sending and receiving activities. While we haven't merged the RFC 9421 implementation branch yet, we're currently conducting interoperability tests with development versions of Mastodon and other implementations. Once these tests confirm compatibility, we'll proceed with the merge.

As noted in the attached docs, although RFC 9421 is the final and official standard for HTTP Signatures, the draft cavage version remains widely used across the . Our double-knocking mechanism ensures maximum compatibility by trying the RFC 9421 version first, then falling back to draft cavage if needed.

Currently, we support RSA-PKCS-v1.5 key pairs for generating HTTP Message Signatures, with plans to expand to other signature types in future releases.

We look forward to contributing to a more standardized and secure fediverse!

HTTP Message Signatures

This API is available since Fedify 1.6.0.

RFC 9421, also known as HTTP Message Signatures, is the final revision of the HTTP Signatures specification. Although it is the official standard, it is not widely used in the fediverse yet. As of May 2025, major ActivityPub implementations, such as Mastodon, et al., still rely on the draft cavage version of HTTP Signatures for signing portable activities.

Fedify automatically signs activities with the sender's private key if the actor keys dispatcher is set and the actor has any RSA-PKCS#1-v1.5 key pair. If there are multiple key pairs, Fedify selects the first RSA-PKCS#1-v1.5 key pair among them.

NOTE

Although HTTP Message Signatures support other than RSA-PKCS#1-v1.5, Fedify currently supports only RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures. This limitation will be lifted in the future releases.
ALT text detailsHTTP Message Signatures This API is available since Fedify 1.6.0. RFC 9421, also known as HTTP Message Signatures, is the final revision of the HTTP Signatures specification. Although it is the official standard, it is not widely used in the fediverse yet. As of May 2025, major ActivityPub implementations, such as Mastodon, et al., still rely on the draft cavage version of HTTP Signatures for signing portable activities. Fedify automatically signs activities with the sender's private key if the actor keys dispatcher is set and the actor has any RSA-PKCS#1-v1.5 key pair. If there are multiple key pairs, Fedify selects the first RSA-PKCS#1-v1.5 key pair among them. NOTE Although HTTP Message Signatures support other than RSA-PKCS#1-v1.5, Fedify currently supports only RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures. This limitation will be lifted in the future releases.
Double-knocking HTTP Signatures

This API is available since Fedify 1.6.0.

As you read above, there are two revisions of HTTP Signatures: the draft cavage version and the RFC 9421 version. The draft cavage version is declared as obsolete, but it is still widely used in the fediverse, and many ActivityPub implementations still rely on it. On the other hand, the RFC 9421 version is the official standard, but it is not widely used yet.

To support both versions of HTTP Signatures, Fedify uses the double-knocking mechanism: trying one version, then falling back to another if rejected. If it's the first encounter with the recipient server, Fedify tries the RFC 9421 version first, and if it fails, it falls back to the draft cavage version. If the recipient server accepts the RFC 9421 version, Fedify remembers it and uses the RFC 9421 version for the next time. If the recipient server rejects the RFC 9421 version, Fedify falls back to the draft cavage version and remembers it for the next time.
ALT text detailsDouble-knocking HTTP Signatures This API is available since Fedify 1.6.0. As you read above, there are two revisions of HTTP Signatures: the draft cavage version and the RFC 9421 version. The draft cavage version is declared as obsolete, but it is still widely used in the fediverse, and many ActivityPub implementations still rely on it. On the other hand, the RFC 9421 version is the official standard, but it is not widely used yet. To support both versions of HTTP Signatures, Fedify uses the double-knocking mechanism: trying one version, then falling back to another if rejected. If it's the first encounter with the recipient server, Fedify tries the RFC 9421 version first, and if it fails, it falls back to the draft cavage version. If the recipient server accepts the RFC 9421 version, Fedify remembers it and uses the RFC 9421 version for the next time. If the recipient server rejects the RFC 9421 version, Fedify falls back to the draft cavage version and remembers it for the next time.
Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We're excited to announce that we've implemented RFC 9421 (HTTP Message Signatures) in , complete with our double-knocking mechanism to maintain backward compatibility with the draft cavage version.

This implementation includes both signature generation and verification, meaning is used when both sending and receiving activities. While we haven't merged the RFC 9421 implementation branch yet, we're currently conducting interoperability tests with development versions of Mastodon and other implementations. Once these tests confirm compatibility, we'll proceed with the merge.

As noted in the attached docs, although RFC 9421 is the final and official standard for HTTP Signatures, the draft cavage version remains widely used across the . Our double-knocking mechanism ensures maximum compatibility by trying the RFC 9421 version first, then falling back to draft cavage if needed.

Currently, we support RSA-PKCS-v1.5 key pairs for generating HTTP Message Signatures, with plans to expand to other signature types in future releases.

We look forward to contributing to a more standardized and secure fediverse!

HTTP Message Signatures

This API is available since Fedify 1.6.0.

RFC 9421, also known as HTTP Message Signatures, is the final revision of the HTTP Signatures specification. Although it is the official standard, it is not widely used in the fediverse yet. As of May 2025, major ActivityPub implementations, such as Mastodon, et al., still rely on the draft cavage version of HTTP Signatures for signing portable activities.

Fedify automatically signs activities with the sender's private key if the actor keys dispatcher is set and the actor has any RSA-PKCS#1-v1.5 key pair. If there are multiple key pairs, Fedify selects the first RSA-PKCS#1-v1.5 key pair among them.

NOTE

Although HTTP Message Signatures support other than RSA-PKCS#1-v1.5, Fedify currently supports only RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures. This limitation will be lifted in the future releases.
ALT text detailsHTTP Message Signatures This API is available since Fedify 1.6.0. RFC 9421, also known as HTTP Message Signatures, is the final revision of the HTTP Signatures specification. Although it is the official standard, it is not widely used in the fediverse yet. As of May 2025, major ActivityPub implementations, such as Mastodon, et al., still rely on the draft cavage version of HTTP Signatures for signing portable activities. Fedify automatically signs activities with the sender's private key if the actor keys dispatcher is set and the actor has any RSA-PKCS#1-v1.5 key pair. If there are multiple key pairs, Fedify selects the first RSA-PKCS#1-v1.5 key pair among them. NOTE Although HTTP Message Signatures support other than RSA-PKCS#1-v1.5, Fedify currently supports only RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures. This limitation will be lifted in the future releases.
Double-knocking HTTP Signatures

This API is available since Fedify 1.6.0.

As you read above, there are two revisions of HTTP Signatures: the draft cavage version and the RFC 9421 version. The draft cavage version is declared as obsolete, but it is still widely used in the fediverse, and many ActivityPub implementations still rely on it. On the other hand, the RFC 9421 version is the official standard, but it is not widely used yet.

To support both versions of HTTP Signatures, Fedify uses the double-knocking mechanism: trying one version, then falling back to another if rejected. If it's the first encounter with the recipient server, Fedify tries the RFC 9421 version first, and if it fails, it falls back to the draft cavage version. If the recipient server accepts the RFC 9421 version, Fedify remembers it and uses the RFC 9421 version for the next time. If the recipient server rejects the RFC 9421 version, Fedify falls back to the draft cavage version and remembers it for the next time.
ALT text detailsDouble-knocking HTTP Signatures This API is available since Fedify 1.6.0. As you read above, there are two revisions of HTTP Signatures: the draft cavage version and the RFC 9421 version. The draft cavage version is declared as obsolete, but it is still widely used in the fediverse, and many ActivityPub implementations still rely on it. On the other hand, the RFC 9421 version is the official standard, but it is not widely used yet. To support both versions of HTTP Signatures, Fedify uses the double-knocking mechanism: trying one version, then falling back to another if rejected. If it's the first encounter with the recipient server, Fedify tries the RFC 9421 version first, and if it fails, it falls back to the draft cavage version. If the recipient server accepts the RFC 9421 version, Fedify remembers it and uses the RFC 9421 version for the next time. If the recipient server rejects the RFC 9421 version, Fedify falls back to the draft cavage version and remembers it for the next time.
Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We're pleased to announce that has been included in the Nivenly Fediverse Security Fund program!

The @nivenly Foundation has launched a security bounty fund to support contributors who identify and help fix vulnerabilities in popular software. Both Fedify and @hollo are among the selected projects that meet their responsible security disclosure requirements.

This program will run from April–September 2025, with bounties of $250–$500 USD for high and critical security vulnerabilities.

We're honored to be recognized alongside other established fediverse projects like Mastodon, Misskey, and Lemmy. This further encourages our commitment to maintaining strong security practices.

If you're interested in contributing to Fedify's security, please follow our responsible disclosure process outlined in our SECURITY.md file.

Learn more about the program:

https://nivenly.org/blog/2025/04/01/nivenly-fediverse-security-fund/

Nicolas Borboën's avatar
Nicolas Borboën

@nborboen@social.epfl.ch

What to learn more about the and ? This tutorial (fedify.dev/tutorial/microblog) from @fedify is a really good starter. It explains how to implement a really simple server and see how communication exchange are done with AP.

https://fedify.dev/ website
ALT text detailshttps://fedify.dev/ website
https://github.com/fedify-dev/fedify
ALT text detailshttps://github.com/fedify-dev/fedify
Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

もしかしたらご存じないかもしれませんが、Fedifyには DiscordとMatrixのコミュニティがあります。ここでは、サポートを受けたり、機能について議論したり、ActivityPubやフェデレーテッドソーシャルネットワークについて話し合うことができます。

お好みのコミュニティにご参加ください。どちらのチャンネルでも、Fedifyやフェデレーション関連のトピックについて活発な議論が行われています。

← Newer
Older →