Screens

A tour of the Obsign app. Every image here is generated automatically from the app’s own browser test harness across named scenarios, so the pictures track the real UI and cannot quietly go stale.

These are browser renders, not device captures

These screenshots come from running the app frontend in a browser (the test harness), not from an iPhone. They faithfully show layout, copy, and states, but a few things only exist on a real device and are not pictured: Face ID / Touch ID prompts, the Keychain / Secure Enclave, the system share sheet, and the exact safe-area insets and font rendering of iOS. Treat these as accurate diagrams of each screen, not pixel-exact device photos.

Getting started

The first launch asks a single question — what’s your situation? — and routes you from your answer: starting fresh, bringing in an account you already have, rebuilding from your backup shares, or getting off a server that’s gone.

First launch: one situation question, routed to the matching flow.

Creating an identity needs a Custos server. Point the wallet at one that only speaks the standard lexicons and it says so on the server screen, before you have filled anything in, with import one tap away.

An honest early stop: this server can host your identity, it just can't create one.

Recovering from backup shares

If your phone is lost, any two of your three backup shares can bring your identity to a new device. Recovery starts from your handle or DID; Share 1 is loaded automatically if iCloud Keychain carried it to the new phone. When it didn’t — iCloud Keychain was off, or the identity predates Obsign syncing that share — the screen says so and your saved Share 3 takes its place. See 2-of-3 Shamir backup.

Recovery starts from a handle or DID; Share 1 auto-loads from the Keychain when it is present.

With one share in hand, the second can come from your server’s escrow (released with an emailed code) or from the word-phrase backup you saved.

Collecting two of three shares: ask the server for its escrow share, or enter a saved one.

A server can hold the escrow share for a waiting period before handing it over. The delay is a protection — anyone still signed in to your account can stop a release they didn’t ask for, and the wait continues on the server even if you close the app.

The escrow waiting period — a release you didn't ask for can be cancelled from any signed-in device.

Your identities

The home surface lists your seals with tamper monitoring shown live at the top.

The home surface, with monitoring shown live at the top.

A single wallet can hold several identities; the root-key badge is tracked per identity.

Several identities in one wallet; the root-key badge is per identity.

Tapping an identity opens its DID document, decoded. A current-model identity carries three rotation keys — your device key, your recovery key, and the server’s key.

An identity's DID document — identifier, handle, all three rotation keys (device, recovery, PDS), services.

An identity created before the recovery-key model was introduced is offered a calm, one-tap upgrade on the home surface — an improvement, not an alarm.

An older identity without a recovery key is offered the upgrade in place.

Signing in to other apps

App passwords are separate, revocable credentials for signing the official Bluesky app — or any app that asks for a password — into your account without ever exposing your keys. Direct-message access is off unless you allow it per credential.

App passwords: what they can and cannot do, and each active credential with its own revoke.

Agents

Agents you have authorized to act on your behalf are listed under My agents, each with its permissions and full activity record.

The agents you've approved, with their permissions and activity record.

Settings

Appearance and app settings.

Backing up your content

The Media backup screen (opened from an identity) holds two backups you control: your media and your posts.

Choosing Back up media keeps your own content-verified copy of that account’s photos and video in iCloud Drive, restorable to your server byte for byte if the server ever loses the originals. The mirror size is always shown.

The media backup for one identity: how much is mirrored, back up now, or restore it to the server.

A Media backup section in Settings keeps opted-in identities topped up in the background, with controls to turn that off, restrict it to while charging, or skip cellular data.

The background media-backup controls in Settings — status is carried by the switch position, never color alone.

Below the media controls, Back up your posts mirrors an integrity-checked snapshot of your repository — every post, like, follow, and profile edit — into the same iCloud Drive. It’s the one part of your account that otherwise lives only on your server.

Backing up your posts — an integrity-checked snapshot of your repository, held in your own iCloud Drive.

When something is wrong

If Obsign detects an unauthorized change to your identity’s public record, the home surface raises an alert — status is always shown with text and an icon, never color alone.

A tamper alert on the home surface — text and icon, not color alone.

Opening the alert shows the change and a live countdown of the 72-hour recovery window.

The alert detail, with a live recovery-window countdown.

Local failures are surfaced inline with a way to retry, never a dead end.

An injected local failure surfaces inline with a retry, never a dead end.