Claim keytrace npm org

[WilhelmBerggren]

Hi, I was looking for examples of npm org claims, and noticed keytrace.dev account hasn't claimed the @keytrace npm org. Perhaps that would be useful? Lead by example? 😄

[orta]

ha

[WilhelmBerggren]

The reason I'm looking at it is I'd like to add an integration to npmx.org so that a claimed org page can link back to its atproto-profile, which then can lead to more social integrations. Once #38 is released on npm I can start working on it!

[WilhelmBerggren]

Likewise someone is working on showing Keytrace claims on an npmx profile page:

[orta]

OK, that's cool

[orta]

Hrm, it's a bit tricky with orgs - it is true that I can make @keytrace/keytrace-claim which does prove today I have access to make this package today but we also don't have enough data in a keytrace claim for someone to be able to know if its an org or a user

I'll take a stab at adding a second 'npm org' claim which means you have access to publish in that org, not that you can log into that user

[orta]

OK: an npm org claim is a different claim type from an npm account claim: https://pdsls.dev/at://did:plc:t732otzqvkch7zz5d37537ry/dev.keytrace.claim/3mrv7kwyx5k2s

Basically we can frame that someone has publish access to the org, and we can say who made the publish:

{
  "type": "npmorg",
  "$type": "dev.keytrace.claim",
  "status": "verified",
  "claimUri": "https://www.npmjs.com/package/@keytrace/keytrace-claim-orta",
  "identity": {
    "account": "orta",
    "subject": "keytrace",
    "profileUrl": "https://www.npmjs.com/org/keytrace",
    "displayName": "@keytrace"
  },
  "createdAt": "2026-07-30T19:50:19.889Z",
  "lastVerifiedAt": "2026-07-30T19:50:19.889Z"
}

[WilhelmBerggren]

Wow, quick work! So now you are able to show that you have publish access to an npm org, and claim an npm profile. Both seem like useful things that could be surfaced on npmx.dev.

My original idea (which was based on a misunderstanding) was that you should associate an npm org with a single atproto identity. Several npm orgs have an associated atproto identity, e.g. bsky.app/profile/vitest.dev.

I think it would be useful to be able to link the two, but I can see why the concept doesn't fully make sense.