# dev.cocore.app.registration

> How an application announces itself to co/core so it can connect users' accounts with one click ("Sign in with co/core"). Published by the application on ITS OWN account (a did:plc or did:web with a repo), one record per DID at rkey `self` — there is no central app registry. When the app calls `dev.cocore.devicePair.start` with `appDid`, the AppView reads this record from the app's PDS: `name` is what the approve screen shows, and `returnUrls` are the only places the approve screen may send the browser afterwards. A return URL is additionally honoured only when its host proves it belongs to this DID by serving `https://<host>/.well-known/cocore-app.json` containing `{"did": "<this DID>"}` — so a record on a stranger's account cannot borrow a real app's domain.

- Kind: record
- Record key: literal:self
- Authority: app.cocore.dev
- Lexicon: 1
- Published by [cocore.dev](https://lexicon.garden/identity/did:plc:5quuhkmwe2q4k3azfsgg7kdz), not the NSID's authority

## Links

- [Documentation](https://lexicon.garden/lexicon/did:plc:5quuhkmwe2q4k3azfsgg7kdz/dev.cocore.app.registration)
- [Schema JSON](https://lexicon.garden/lexicon/did:plc:5quuhkmwe2q4k3azfsgg7kdz/dev.cocore.app.registration/schema.json)
- [Analytics](https://lexicon.garden/lexicon/did:plc:5quuhkmwe2q4k3azfsgg7kdz/dev.cocore.app.registration/analytics)

## Record (`dev.cocore.app.registration`)

Type: record · key literal:self

### Properties

- `createdAt` (string · datetime, required)
- `description` (string): One sentence on what the app does with the connection. Plain text.
  - Constraints: maxLength: 300
- `iconUrl` (string · uri): Square icon, https. Optional.
  - Constraints: maxLength: 2048
- `name` (string, required): Human name of the application, shown on the approve screen.
  - Constraints: maxLength: 40
- `returnUrls` (array, required): Where the approve screen may send the browser after approval. https only. A requested return URL must match one of these on origin and path (its query string may differ).
  - Constraints: maxLength: 10
  - `items` (string · uri)
    - Constraints: maxLength: 2048
- `updatedAt` (string · datetime)
- `website` (string · uri): The app's home page, linked from the approve screen.
  - Constraints: maxLength: 2048

## Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "key": "literal:self",
      "record": {
        "properties": {
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "description": {
            "description": "One sentence on what the app does with the connection. Plain text.",
            "maxLength": 300,
            "type": "string"
          },
          "iconUrl": {
            "description": "Square icon, https. Optional.",
            "format": "uri",
            "maxLength": 2048,
            "type": "string"
          },
          "name": {
            "description": "Human name of the application, shown on the approve screen.",
            "maxLength": 40,
            "type": "string"
          },
          "returnUrls": {
            "description": "Where the approve screen may send the browser after approval. https only. A requested return URL must match one of these on origin and path (its query string may differ).",
            "items": {
              "format": "uri",
              "maxLength": 2048,
              "type": "string"
            },
            "maxLength": 10,
            "type": "array"
          },
          "updatedAt": {
            "format": "datetime",
            "type": "string"
          },
          "website": {
            "description": "The app's home page, linked from the approve screen.",
            "format": "uri",
            "maxLength": 2048,
            "type": "string"
          }
        },
        "required": [
          "name",
          "returnUrls",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "How an application announces itself to co/core so it can connect users' accounts with one click (\"Sign in with co/core\"). Published by the application on ITS OWN account (a did:plc or did:web with a repo), one record per DID at rkey `self` — there is no central app registry. When the app calls `dev.cocore.devicePair.start` with `appDid`, the AppView reads this record from the app's PDS: `name` is what the approve screen shows, and `returnUrls` are the only places the approve screen may send the browser afterwards. A return URL is additionally honoured only when its host proves it belongs to this DID by serving `https://<host>/.well-known/cocore-app.json` containing `{\"did\": \"<this DID>\"}` — so a record on a stranger's account cannot borrow a real app's domain.",
  "id": "dev.cocore.app.registration",
  "lexicon": 1
}
```