This account has moved to:

Fedify: ActivityPub server framework's avatar

Fedify: ActivityPub server framework

@fedify@hollo.social

9 following270 followers

:fedify: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

Pinned

🎉 Excited to announce that is now on Open Collective! Support the project's development starting at:

  • Backer (from $5/mo)
  • Supporter (from $25/mo)
  • Sponsor (from $100/mo)
  • Corporate Sponsor (from $500/mo)
  • Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

:fedify:

Fedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.
ALT text

Fedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.

Pinned

Fedify is an server framework in & . It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

If you're curious, take a look at the website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

@box464@mastodon.social

Using @fedify to see how far I can get with very simplistic AP objects and activities. The tutorial and documentation was helpful and gave me a solid template to work from.

The fedify CLI is a great debugging tool, too.

The built in tunnel command makes it a snap to spin up temporary servers that are open to the public web for testing. Here I have two instances spun up so I can send activities between them.

1/2

Fedify is running in four different kitty windows, two are running the app, two are running temporary tunnels.
ALT text

Fedify is running in four different kitty windows, two are running the app, two are running temporary tunnels.

@hongminhee@hollo.social
@hongminhee@hollo.social
@hongminhee@hollo.social

Recently, @moreal built ap-thread-reader, a tool that displays threaded posts on a single page. Works with any ActivityPub platform, not just Mastodon.

Try it at https://ap-thread-reader.fly.dev/.

Built with Fedify and released as open source: https://github.com/moreal/ap-thread-reader.

More details at https://blog.moreal.dev/2026/02/ap-thread-reader-introduction/index.en.html.

blog.moreal.dev

ap-thread-reader, ActivityPub-compatible Thread Reader — 잡다한 블로그

Introduce ap-thread-reader's feature

It was great to see fantastic people at @offline today, and thank you for listening my talk! If you'd like to get my deck, here it is: Fedify: Building ActivityPub servers without the pain.

Huge thanks @liaizon for organizing this event!

social.wake.st

wakest ⁂ FOSDEM (@liaizon@wake.st)

Attached: 1 image On February 3rd (very soon!) I am hosting another [BERLIN FEDERATED NETWORK EXPLORATION CIRCLE] at @offline@autonomous.zone. It's a chance to meet and talk with people who are interested in the #fediverse & networking & exploration & circ---you get the idea. We have the pleasure of having @hongminhee@hollo.social who will give a presentation about @fedify@hollo.social "an opinionated #ActivityPub framework for TypeScript that handles the protocol plumbing" It is an open free event and everyone is welcome!

@liaizon@wake.st

On February 3rd (very soon!) I am hosting another [BERLIN FEDERATED NETWORK EXPLORATION CIRCLE] at @offline. It's a chance to meet and talk with people who are interested in the & networking & exploration & circ---you get the idea.

We have the pleasure of having @hongminhee who will give a presentation about @fedify "an opinionated framework for TypeScript that handles the protocol plumbing"

It is an open free event and everyone is welcome!

BERLIN FEDERATED NETWORK EXPLORATION CIRCLE
BEFENEC? BEFENEEXCI?
we have 洪 民憙 (Hong Minhee) all the way here from 
Korea with a presentation about Fedify, a fediverse
library they have been building that is now powering
the federation of things like Ghost and Hackers' Pub

come join us offline
at offline
Lichtenrader Str. 49
Berlin
ALT text

BERLIN FEDERATED NETWORK EXPLORATION CIRCLE BEFENEC? BEFENEEXCI? we have 洪 民憙 (Hong Minhee) all the way here from Korea with a presentation about Fedify, a fediverse library they have been building that is now powering the federation of things like Ghost and Hackers' Pub come join us offline at offline Lichtenrader Str. 49 Berlin

Thanks all for listening to my talk about at 2026 today! Here's my deck for the talk: Fedify: Building ActivityPub servers without the pain.

hongminhee.codeberg.page

Fedify: Building ActivityPub servers without the pain - Slidev

"Implementing ActivityPub looks simple at first—it's just JSON over HTTP,\nright? Then you hit JSON-LD context resolution. Then HTTP Signature\nverification fails on Mastodon but works on Misskey. Then you realize\nthe spec spans hundreds of pages across W3C documents and [FEPs] (Fediverse\nEnhancement Proposals), and every implementation interprets them differently.\n\nI went through this pain building [Hollo], a single-user microblogging server.\nHalfway through, I realized I was building a framework instead of an app.\nSo I extracted that framework and called it Fedify.\n\n[Fedify] is an opinionated ActivityPub framework for TypeScript. It handles\nthe protocol plumbing so you can focus on your application logic.\n\nIn this talk, I'll cover:\n\n - *Type-safe vocabulary:* The Activity Vocabulary spec is loosely defined,\n but Fedify maps it to strict TypeScript types. Your IDE knows that\n `Note.content` is a `LanguageString`, and calling\n `await create.getActor()` returns an `Actor` object.\n No more guessing at property shapes.\n\n - *Comprehensive signature support:* Fedify implements four authentication\n mechanisms—HTTP Signatures (draft-cavage), HTTP Message Signatures (RFC\n 9421), Linked Data Signatures, and Object Integrity Proofs (FEP-8b32).\n For HTTP Signatures, it uses [double-knocking]: trying RFC 9421 first,\n falling back to draft-cavage if rejected, and remembering the preference.\n This kind of interoperability work is exactly what you shouldn't have to\n do yourself.\n\n - *Framework-agnostic design:* Fedify works as middleware for Hono, Express,\n Fastify, Next.js, or any framework that speaks `Request`/`Response`.\n Bring your own database, ORM, and auth—Fedify only needs a key–value store\n for caching.\n\n - *CLI toolchain:* The `fedify inbox` command spins up an ephemeral server\n to receive and inspect activities. `fedify lookup` fetches any ActivityPub\n object by URL or fediverse handle—including from servers that require\n [authorized fetch]. No need to create throwaway accounts on production\n instances.\n\nI'll also share production stories: [Ghost chose Fedify] for federating their\npublishing platform rather than implementing the protocol themselves. Hollo\ndemonstrates single-user microblogging with full Mastodon API compatibility.\n[Hackers' Pub] shows how a developer community can integrate with\nthe fediverse.\n\nWhether you're building a new federated service or adding ActivityPub to\nan existing app, this talk will show you how Fedify turns months of protocol\nwrangling into days of actual development.\n\n[FEPs]: https://w3id.org/fep/\n[Hollo]: https://docs.hollo.social/\n[Fedify]: https://fedify.dev/\n[double-knocking]: https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions\n[authorized fetch]: https://swicg.github.io/activitypub-http-signature/#authorized-fetch\n[Ghost chose Fedify]: https://activitypub.ghost.org/day-4/\n[Hackers' Pub]: https://hackers.pub/\n"

We've published an AI usage policy for the Fedify project, inspired by Ghostty's approach.

TL;DR: AI tools are welcome, but contributions must disclose AI usage, be tied to accepted issues, and be human-verified. Maintainers are exempt.

https://github.com/fedify-dev/fedify/blob/main/AI_POLICY.md

github.com

fedify/AI_POLICY.md at main · fedify-dev/fedify

ActivityPub server framework in TypeScript. Contribute to fedify-dev/fedify development by creating an account on GitHub.

@kosui@blog.kosui.me · Reply to kosui

ioriとFedify

ioriがActivityPubをサポートできているのは、間違いなくFedifyのおかげである。

自分でActivityPubの仕様を一から実装しようとしたことはこれまでに何度もあるが、以下の問題にぶつかり、いつも挫折してきた。

  • データモデリングの対象が広範囲に及ぶ
    • Vocabularyが多岐にわたる
    • オブジェクトタイプやアクタータイプが多い
  • ネットワーク通信の仕様が複雑
    • HTTPシグネチャチャの実装
    • JSON-LDのコンテキスト解決

私が本当に提供したいのはナレッジ管理サービスであり、ActivityPubの実装ではない。Fedifyはこれらの複雑さを抽象化し、開発者がビジネスロジックに集中できるようにしてくれる。

@julian@fietkau.social · Reply to @reiver ⊼ (Charles) :batman:

@reiver From personal experience, at the very least anything based on @fedify can represent multiple keys for an actor.

FEP-521a has a list of implementations: codeberg.org/fediverse/fep/src

On changing keys, I used to think this was impossible, but then I saw Claire mention that Mastodon will simply accept a changed key as long as the valid updated actor can be fetched from its canonical URI. So I guess that might work straightforwardly?

codeberg.org

Cookie monster!

@monaco_koukoku@fedibird.com

Fedifyってテスト用に相手のAPサーバーのモック的なのが使えるのね。署名やネットワークのことを気にせずにActivityの送受信をテストできると。素晴らしい。
fedify.dev/manual/test#mocking

fedify.dev

Testing | Fedify

Testing a federated server app is a bit tricky because it requires a federated environment. This document explains how to easily test your federated server app with the help of several tools.

@bananamilk452@hackers.pub

요즘 fedify를 이용한 연합되는 블로그 만들기에 열 올리고 있는데... 참 재밌는 것 같아요. fedify도 참 잘 만든 라이브러리인 것 같구... 나중에 블로그 실서비스 하게 될 때가 기대되네요♡

Fedify 1.10.0: Observability foundations for the future debug dashboard

Fedify is a framework for building servers that participate in the . It reduces the complexity and boilerplate typically required for ActivityPub implementation while providing comprehensive federation capabilities.

We're excited to announce 1.10.0, a focused release that lays critical groundwork for future debugging and observability features. Released on December 24, 2025, this version introduces infrastructure improvements that will enable the upcoming debug dashboard while maintaining full backward compatibility with existing Fedify applications.

This release represents a transitional step toward Fedify 2.0.0, introducing optional capabilities that will become standard in the next major version. The changes focus on enabling richer observability through OpenTelemetry enhancements and adding prefix scanning capabilities to the key–value store interface.

Enhanced OpenTelemetry instrumentation

Fedify 1.10.0 significantly expands OpenTelemetry instrumentation with span events that capture detailed ActivityPub data. These enhancements enable richer observability and debugging capabilities without relying solely on span attributes, which are limited to primitive values.

The new span events provide complete activity payloads and verification status, making it possible to build comprehensive debugging tools that show the full context of federation operations:

  • activitypub.activity.received event on activitypub.inbox span — records the full activity JSON, verification status (activity verified, HTTP signatures verified, Linked Data signatures verified), and actor information
  • activitypub.activity.sent event on activitypub.send_activity span — records the full activity JSON and target inbox URL
  • activitypub.object.fetched event on activitypub.lookup_object span — records the fetched object's type and complete JSON-LD representation

Additionally, Fedify now instruments previously uncovered operations:

  • activitypub.fetch_document span for document loader operations, tracking URL fetching, HTTP redirects, and final document URLs
  • activitypub.verify_key_ownership span for cryptographic key ownership verification, recording actor ID, key ID, verification result, and the verification method used

These instrumentation improvements emerged from work on issue #234 (Real-time ActivityPub debug dashboard). Rather than introducing a custom observer interface as originally proposed in #323, we leveraged Fedify's existing OpenTelemetry infrastructure to capture rich federation data through span events. This approach provides a standards-based foundation that's composable with existing observability tools like Jaeger, Zipkin, and Grafana Tempo.

Distributed trace storage with FedifySpanExporter

Building on the enhanced instrumentation, Fedify 1.10.0 introduces FedifySpanExporter, a new OpenTelemetry SpanExporter that persists ActivityPub activity traces to a KvStore. This enables distributed tracing support across multiple nodes in a Fedify deployment, which is essential for building debug dashboards that can show complete request flows across web servers and background workers.

The new @fedify/fedify/otel module provides the following types and interfaces:

import { MemoryKvStore } from "@fedify/fedify";
import { FedifySpanExporter } from "@fedify/fedify/otel";
import {
  BasicTracerProvider,
  SimpleSpanProcessor,
} from "@opentelemetry/sdk-trace-base";

const kv = new MemoryKvStore();
const exporter = new FedifySpanExporter(kv, {
  ttl: Temporal.Duration.from({ hours: 1 }),
});

const provider = new BasicTracerProvider();
provider.addSpanProcessor(new SimpleSpanProcessor(exporter));

The stored traces can be queried for display in debugging interfaces:

// Get all activities for a specific trace
const activities = await exporter.getActivitiesByTraceId(traceId);

// Get recent traces with summary information
const recentTraces = await exporter.getRecentTraces({ limit: 100 });

The exporter supports two storage strategies depending on the KvStore capabilities. When the list() method is available (preferred), it stores individual records with keys like [prefix, traceId, spanId]. When only cas() is available, it uses compare-and-swap operations to append records to arrays stored per trace.

This infrastructure provides the foundation for implementing a comprehensive debug dashboard as a custom SpanExporter, as outlined in the updated implementation plan for issue #234.

Optional list() method for KvStore interface

Fedify 1.10.0 adds an optional list() method to the KvStore interface for enumerating entries by key prefix. This method enables efficient prefix scanning, which is useful for implementing features like distributed trace storage, cache invalidation by prefix, and listing related entries.

interface KvStore {
  // ... existing methods
  list?(prefix?: KvKey): AsyncIterable<KvStoreListEntry>;
}

When the prefix parameter is omitted or empty, list() returns all entries in the store. This is useful for debugging and administrative purposes. All official KvStore implementations have been updated to support this method:

  • MemoryKvStore — filters in-memory keys by prefix
  • SqliteKvStore — uses LIKE query with JSON key pattern
  • PostgresKvStore — uses array slice comparison
  • RedisKvStore — uses SCAN with pattern matching and key deserialization
  • DenoKvStore — delegates to Deno KV's built-in list() API
  • WorkersKvStore — uses Cloudflare Workers KV list() with JSON key prefix pattern

While list() is currently optional to give existing custom KvStore implementations time to add support, it will become a required method in Fedify 2.0.0 (tracked in issue #499). This migration path allows implementers to gradually adopt the new capability throughout the 1.x release cycle.

The addition of list() support was implemented in pull request #500, which also included the setup of proper testing infrastructure for WorkersKvStore using Vitest with @cloudflare/vitest-pool-workers.

NestJS 11 and Express 5 support

Thanks to a contribution from Cho Hasang (@crohasang), the @fedify/nestjs package now supports NestJS 11 environments that use Express 5. The peer dependency range for Express has been widened to ^4.0.0 || ^5.0.0, eliminating peer dependency conflicts in modern NestJS projects while maintaining backward compatibility with Express 4.

This change, implemented in pull request #493, keeps the workspace catalog pinned to Express 4 for internal development and test stability while allowing Express 5 in consuming applications.

What's next

Fedify 1.10.0 serves as a stepping stone toward the upcoming 2.0.0 release. The optional list() method introduced in this version will become required in 2.0.0, simplifying the interface contract and allowing Fedify internals to rely on prefix scanning being universally available.

The enhanced instrumentation and FedifySpanExporter provide the foundation for implementing the debug dashboard proposed in issue #234. The next steps include building the web dashboard UI with real-time activity lists, filtering, and JSON inspection capabilities—all as a separate package that leverages the standards-based observability infrastructure introduced in this release.

Depending on the development timeline and feature priorities, there may be additional 1.x releases before the 2.0.0 migration. For developers building custom KvStore implementations, now is the time to add list() support to prepare for the eventual 2.0.0 upgrade. The implementation patterns used in the official backends provide clear guidance for various storage strategies.

Acknowledgments

Special thanks to Cho Hasang (@crohasang) for the NestJS 11 compatibility improvements, and to all community members who provided feedback and testing for the new observability features.

For the complete list of changes, bug fixes, and improvements, please refer to the CHANGES.md file in the repository.

github.com

fedify/CHANGES.md at main · fedify-dev/fedify

ActivityPub server framework in TypeScript. Contribute to fedify-dev/fedify development by creating an account on GitHub.

On a related note, if you learn better by building things, @fedify has a step-by-step tutorial where you create a federated microblog from scratch—implementing actors, inbox/outbox, following, and posts along the way:

https://fedify.dev/tutorial/microblog

fedify.dev

Creating your own federated microblog | Fedify

In this tutorial, we will build a small microblog that implements the ActivityPub protocol, similar to Mastodon or Misskey, using Fedify, an ActivityPub server framework.

@tchambers@indieweb.social

🚨 Security Advisory: CVE-2025-68475

A ReDoS (Regular Expression Denial of Service) vulnerability has been discovered in Fedify's HTML parsing code. This vulnerability could allow a malicious federated server to cause denial of service by sending specially crafted HTML responses.

CVE ID CVE-2025-68475
Severity High (CVSS 7.5)
Affected versions ≤1.9.1
Patched versions 1.6.13, 1.7.14, 1.8.15, 1.9.2

If you're running Fedify in production, please upgrade to one of the patched versions immediately.

For full details, see the security advisory: https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93

Thank you to Yue (Knox) Liu for responsibly reporting this vulnerability.

github.com

ReDoS Vulnerability in HTML Parsing Regex

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...

We've been struggling with a JSR publishing issue for nearly two months now—@fedify/cli and @fedify/testing packages hang indefinitely during the server-side processing stage, blocking our releases. Strangely, the problem doesn't reproduce on a local JSR server at all.

We've opened a GitHub issue to track this: https://github.com/jsr-io/jsr/issues/1238.

Fedify has been a Deno-first, JSR-first project from the start, and we really want to keep it that way. If you've experienced similar issues or have any insights, we'd appreciate your input on the issue.

github.com

Publishing hangs indefinitely for `@fedify/cli` and `@fedify/testing` packages · Issue #1238 · jsr-io/jsr

Hi JSR team, I'm the maintainer of Fedify, an ActivityPub framework for TypeScript. I've been experiencing a persistent issue where publishing @fedify/cli and @fedify/testing packages hangs indefin...

@julian@activitypub.space · Reply to Stéphane
@hongminhee@hollo.social

codeberg.org

yt-on-fedi

yt-on-fedi

@chris@nutmeg.social

It's alive! 🧟

After a bit of trial-error, got fediverse comments showing on a site running . My personal fediverse-connected youtube mirror is now mostly feature complete.
(The video post in the screenshot is over here: watch.hayes.software/video/16)

Screenshot of a website with a big video player playing a video titled, "Citadel blasting Caramelldansen" Below it is a comment section. The comment field says you can comment on videos by connecting your Mastodon account. The comment section has a single comment, "This is a test comment." Which is a comment I made from mastodon.social that now automagically shows on my video site. Yay!
ALT text

Screenshot of a website with a big video player playing a video titled, "Citadel blasting Caramelldansen" Below it is a comment section. The comment field says you can comment on videos by connecting your Mastodon account. The comment section has a single comment, "This is a test comment." Which is a comment I made from mastodon.social that now automagically shows on my video site. Yay!