docs/_develop/profiles.md

layout	permalink
learn	/:collection/:path.html

Work with Profiles

{:.no_toc}

Blockstack Auth provides single sign on and authentication without third parties or remote servers. On this page, you'll get an overview of authentication from an developer and user perspective. The following topics are covered:

• TOC {:toc}

You can use the blockstack.js library to create and register an ID on the Stacks blockchain. Follow these steps to create and register a profile for a Blockchain ID:

1. Create a JSON profile object
2. Split up the profile into tokens, sign the tokens, and put them in a token file
3. Create a zone file that points to the web location of the profile token file

Create a profile

const profileOfNaval = {
  "@context": "http://schema.org/",
  "@type": "Person",
  "name": "Naval Ravikant",
  "description": "Co-founder of AngelList"
}

Sign a profile as a single token

import { makeECPrivateKey, wrapProfileToken, Person } from 'blockstack'

const privateKey = makeECPrivateKey()

const person = new Person(profileOfNaval)
const token = person.toToken(privateKey)
const tokenFile = [wrapProfileToken(token)]

Verify an individual token

import { verifyProfileToken } from 'blockstack'

try {
  const decodedToken = verifyProfileToken(tokenFile[0].token, publicKey)
} catch(e) {
  console.log(e)
}

Recover a profile from a token file

const recoveredProfile = Person.fromToken(tokenFile, publicKey)

Validate profile schema

const validationResults = Person.validateSchema(recoveredProfile)

Where profile data is stored

Profile data is stored using Gaia on the user's selected storage provider.

An example of a profile.json file URL using Blockstack provided storage: https://gaia.blockstack.org/hub/1EeZtGNdFrVB2AgLFsZbyBCF7UTZcEWhHk/profile.json

Validate a proof

import { validateProofs } from 'blockstack'

const domainName = "naval.id"
validateProofs(profile, domainName).then((proofs) => {
  console.log(proofs)
})

How proofs are validated

The validateProofs function checks each of the proofs listed in the profile by fetching the proof URL and verifying the proof message.

The proof message must be of the form:

Verifying my Blockstack ID is secured with the address
1EeZtGNdFrVB2AgLFsZbyBCF7UTZcEWhHk

The proof message also must appear in the required location on the proof page specific to each type of social media account.

The account from which the proof message is posted must match exactly the account identifier/username claimed in the user profile. The validateProofs function will check this in the body of the proof or in the proof URL depending on the service.

Adding additional social account validation services

The Service class can be extended to provide proof validation service to additional social account types. You will need to override the getProofStatement(searchText: string) method which parses the proof body and returns the proof message text. Additionally, the identifier claimed should be verified in the proof URL or in the body by implementing getProofIdentity(searchText: string) and setting shouldValidateIdentityInBody() to return true.

The following snippet uses the meta tags in the proof page to retrieve the proof message.

static getProofStatement(searchText: string) {
	const $ = cheerio.load(searchText)
	const statement = $('meta[property="og:description"]')
	                    .attr('content')

	if (statement !== undefined && statement.split(':').length > 1) {
	  return statement.split(':')[1].trim().replace('“', '').replace('”', '')
	} else {
	  return ''
	}
}

Currently supported proof validation services

• Facebook
• Twitter
• Instagram
• LinkedIn
• Hacker News
• GitHub

Profile proof schema

Proofs are stored under the account key in the user's profile data

"account": [
	{
	  "@type": "Account",
	  "service": "twitter",
	  "identifier": "naval",
	  "proofType": "http",
	  "proofUrl": "https://twitter.com/naval/status/12345678901234567890"
	}
]