PACT
Self-owned SSO built on Nostr. Live at pact.inertspace.com.
What it is
PACT is a self-owned SSO built on Nostr. Your npub is your identity. A site that adopts PACT can accept a PACT login, and your account travels with you. AnalogCirc.us is the first.
The service is publicly live at pact.inertspace.com. It has four parts: the identity service itself, a browser extension that lets a site ask your browser to sign for you, a PHP SDK so any PHP site can accept a PACT login, and an account page where you manage your key.
Why it matters
Every community server built so far has to reinvent user auth, member records, and social presence. That is duplicated work at every server, and it re-centralizes the exact thing we are trying to distribute. PACT dissolves that problem by making identity live with the user, not the server.
It is also what makes paid membership portable. When a TentCities member joins one community, their status can be verified by another without either community owning the account.
Current state
Live surface: pact.inertspace.com is up, and every AnalogCirc.us account runs on it. Joining AnalogCirc.us creates a PACT identity, and a paid membership is issued as a PACT credential. The browser extension works but is not in the Chrome Web Store yet.
What landed since: the account is now something a member genuinely controls rather than something a site holds for them. Two-factor is owned by PACT rather than by any one site's login page, so turning it on protects every surface at once. A member can reset a forgotten password, and can delete their identity outright, which removes it from both the directory and the key store in a single operation. A tent can also now ask who its members are, which sounds obvious and was previously impossible.
What is next: the tent-affiliation flow, and the extension in the Web Store.
Connections
Every account on AnalogCirc.us runs on PACT. Will be the identity under TentCities once tents adopt the SDK. Owned by the Cooperative.
Build log
Two weeks from first line of code to publicly-live service. That kind of pace only works because Nostr already did the hard part.
-
Concept
The identity problem inside portability
If a member can move their site between community servers but their login still lives at a rented account somewhere, the portability is a promise, not a fact. PACT is the answer to that.
-
Jul 3, 2026
First line of code v0
Backend, extension, site, and SDK all begin life as one service.
More
- Node backend: the API surface at pact.inertspace.com. Handles account lifecycle, session issuance, key custody.
- Chrome MV3 extension: provides
window.nostrto any site that asks for NIP-07. Turns the browser into a Nostr signer. - Single-page site: the account management surface for PACT itself. Where a member creates, backs up, or graduates their key.
- PHP SDK: a first tent-side integration seam, so a WP-based site can accept PACT logins without rebuilding the world.
-
Jul 13, 2026
Off the workstation
The service moves off local development and onto cooperative infrastructure.
-
Jul 14, 2026
pact.inertspace.com publicly live
The SPA frontend goes public. From here, an npub is a real login you can walk into a site with.
More
- The public surface handles the whole account lifecycle from one page: create a hosted key, back it up, or graduate to full self-custody.
- The extension callback flow is wired: with the extension installed, a site can sign you in with your key and land you back authenticated.
- An npub as a login is now a real thing, not a design doc.
-
Jul 15, 2026
"Go Sovereign" graduation path + integration pattern locked
A member can graduate a hosted key to a fully self-custody one. The pattern for how tent-side sites talk to PACT is decided and written down.
-
Jul 18, 2026
Live service, wired into AnalogCirc.us dues
The service is up, and AnalogCirc.us member dues run on it (landed Jul 16). The paid-membership flow was the next thing to ship, and it did.
-
Jul 21 – 22, 2026
The account becomes something you actually control
Two-factor, password reset, and account deletion land together. Between them they turn a hosted identity from something a site keeps for you into something you hold.
More
- Two-factor belongs to PACT, not to a site. If each tent implemented its own, protection would be as weak as the least careful tent. Owning it at the identity layer means turning it on once protects every surface.
- Deletion is the one that matters most. An identity system that cannot delete an identity is a system that has decided your data belongs to it. Deletion removes the account from the directory and its keys together, and leaves nothing orphaned behind.
- Lock-out recovery came along with it. Two-factor without a recovery path just relocates the failure.
-
Aug 7 – 11, 2026
A tent can ask who its members are
A roster endpoint, and the SDK call that reads it. Obvious in hindsight, and genuinely impossible before: a community running on portable identity could not previously enumerate its own membership.
More
- This is the tension in portable identity made concrete. If the account does not belong to the community, the community has to be granted a view of it rather than assuming one.
- Deletion was tightened at the same time: PACT only removes what PACT created, never a whole subtree it merely happens to sit in.
-
Aug 17, 2026
Production redeploy, and deletion works for real
Everything above reached production together. Identity deletion completed end to end for the first time, with nothing left behind.
More
- The ordering was load-bearing. Ship the new code before the database it expects and every member holding an identity gets a silent server error on login instead of a login. Migrations first, then the image.
- Worth stating plainly: the interesting part of a deploy is rarely the feature. It is the order in which the pieces are allowed to arrive.
-
Oct 21, 2026 You are here
PACT gets a database of its own
PACT now keeps its data in a database of its own, apart from everything else on the server. Before the switch, its backup was restored into an empty copy to prove it was complete. The switch itself took three seconds, and every identity came across unchanged.
-
Next
Tent affiliation, and the extension in the Web Store
The tent-affiliation flow, end to end, and the extension in the Chrome Web Store.