Skip to content
Obsign & Custos Docs

Running Custos

Custos is the server side: the PDS that hosts identities and the operator console that manages it. The surface reports the literal truth of what the machine is doing.

If you are using an identity rather than running a server, you want Using Obsign instead.

Custos operator console home screen for minting a device-signed account claim code
The operator console — minting a device-signed claim code for the active relay. See every console screen in the tour.

What you run

Section titled “What you run”
  • Running a relay — stand up the PDS, its health, and what you are (and aren’t) responsible for.
  • Configuration — the config and environment surface that tunes a deployment.
  • Moderation — takedown, restore, credential revocation, and account repair from the operator console.
  • Master-key disaster runbook — what to do if the KEK is lost or compromised.

Which key you hold

Section titled “Which key you hold”

The one thing to internalize before running Custos: you hold the last rotation key, not the first.

rotationKeys[0]  →  the user's device key     (highest precedence)
rotationKeys[1]  →  the user's recovery key   (from their 2-of-3 backup)
rotationKeys[2]  →  the server's key          (yours, lowest precedence)

Accounts created before on-device recovery keys carry two entries (the user’s device key, then yours) until their wallet adds the recovery key; your key is last either way. The user can always override you. That property is what lets a user leave your server without your permission, and it’s what makes hosting trustworthy rather than custodial.