pyroclastic.cloud · recovery key guide

Recovery Key Guide

A rotation key lets you take back control of your identity if your hosting provider disappears or acts against you. This page safely and securely creates one in your browser. It does not transmit generated keys, and works offline. Have your password manager open before you begin.

—
Safe to share. This is the value you give to goat in step 4 below.
—
Never share this. Anyone who has it can take control of your identity. Copy works without revealing it.

Save it in your password manager

TitleRecovery key Usernameyour handle or DID Password— Notes—

Check your saved key

Paste the secret back from your password manager. The page re-derives the public key and confirms they match.
The staff and operators of Pyroclastic Cloud and Bluesky Social will never ask for this key and cannot recover it. Store the secret key securely. If you accidentally share the secret key or the secret key is revealed online, replace it by generating a new one using this process.
Clears both keys from this page.

Add the key to your identity with goat

goat is the command-line tool Bluesky's own account recovery guide uses. Each command below already contains your public key, so you can copy it as it is.

  1. 1

    Install goat

    On a Mac, open the Terminal app and run this. On other systems, follow the notes in the goat repository.
    brew install goat
  2. 2

    Log in to your account

    You must use your account password, not an app-password, for this process. Replace the parts in angle brackets.
    goat account login -u <your handle> -p <account password>
  3. 3

    Request a confirmation code

    Your provider emails a code to the address on your account. Keep it handy for the next step.
    goat account plc request-token
  4. 4

    Add your public key at the front of the list

    This command takes your public key, the did:key:… value labelled Public Key above, and it already contains it. Never paste your secret key into this command, or into any other command on this page.
    --first puts your key ahead of your provider's key, so within 72 hours it can undo any change they make. That is also why the secret must stay private.
    goat account plc add-rotation-key --first --token <code from email> did:key:…
  5. 5

    Confirm it worked

    The output lists rotationKeys. Your public key should be the first entry.
    goat account plc current
  6. 6

    Log out when you are done

    Especially on a shared computer.
    goat account logout

The secret in your password manager is a recovery tool. You will only use it if your provider disappears, is compromised, or changes your identity without asking. When that day comes, follow the account recovery guide and sign with goat plc sign --plc-signing-key.