So you've moved to a new PDS. What does that mean exactly? Well in a nut shell it means your account is now hosted on a server owned by the PDS admin. Sometimes a PDS admin is an organization like blackskyweb.xyz or northskysocial.com that manages the server(PDS). It may even be an individual like me with selfhosted.social, or @angrydutchman.peedee.es with peedee.es. This server(PDS) hosts your account, it's where you sign in now. It's where your posts, likes, pictures, and anything you create on Bluesky/atproto is stored.
Have you ever had a laptop crash on you? You lost everything you had on it? Maybe you've dropped a phone at the bottom of the river to never be seen again, losing all of your pictures and texts. Well, servers(PDS) are just computers. Just like your laptop or phone, if something goes wrong with the server(PDS), the data on it can be lost to time itself. This includes your Bluesky/atproto account. Your PDS admin should be keeping backups in case this ever happens, and I am sure that many do. But what happens if something goes wrong with those backups? Or Heaven forbids something happens to the PDS admin/organization? Well, Bluesky/atproto is built in a way(decentralized) that you can be fully in control of your identity and your data and this will just be a minor inconvenience for you if you have a Rotation Key and regular backups running. With those you can be up and running in usually less than an hour.
Rotation Keys
In my last post I talked about a public address book called the PLC(Public Ledger of Credential). This is how all atprotocol applications know where your data is hosted. Bluesky, skylight.social, stream.place,flashes.blue, etc anything you login with your Bluesky/atproto account finds where your data is hosted from the PLC. It's a global address book(Yellowpages) for the majority of Bluesky/atproto accounts. It's the authority of where you login and where applications should load your data. If you used pdsmoover.com the "Sign the papers" screen is you submitting a change to the PLC to have it change that PDS location to the new one. To submit that change a Rotation Key is needed. You can think of a Rotation Key as a password that allows the PLC to update your change in PDS(address).
This is usually done by you getting a PLC request code in your email and entering it on your migration service like pdsmoover.com or tektite.cc. You'll get an email like the one below, take the code, enter it on the migration service and your account is moved to the new PDS just like that.
This change is submitted by a Rotation Key that your PDS controls. The PDS keeps this Rotation Key private and uses it for all accounts it hosts. This is the normal way to do an account migration and is by far the easiest route. But what happens if the server(PDS) is down? The PDS Admin is not responding to any messages, your Bluesky/atproto login is not working anywhere. Where do you go from here? Is your account lost for good?
Thanks to Bluesky/atproto being decentralized and if you add a Rotation Key that you own you can submit changes to the PLC without your PDS even being turned on. This is usually what we call an a adversarial migration, meaning your PDS is your adversary since it cannot succesfully migrate your account to a new PDS.
There's a few ways you can get a Rotation Key that you "own". Where just means you know the private key and it is assocated with your Bluesky/atproto account. Again it's a lot like a password or a recovery phrase.
When you migrate with pdsmoover.com now at the end there is a check box that says "Create and add a new Rotation Key". This will then show you a screen at the end of the migration to download a file with all the information you need to use one.
When you sign up for backups on pdsmoover.com/backups it will ask you a similar question and give you the option
You can use the Ticket Booth feature on atpairport.com/ticket-booth that will add a new Rotation Key and give you a similar file to download
When you add a new Rotation Key to your account it is associated with your Bluesky/atproto account on the PLC. Much like a password it is important to keep this private and in a secure location. With this key a bad actor/hacker could take control of your account, even if they do not know the password. Similar to a recovery key for another service. This is also THE ONLY way you can recover your account if something ever happens to your new PDS. Bluesky can't help you, I can't help you, no one can. That is why it is important that you have one and keep it safe and somewhere private.
Not sure if you have one added to your account? I made this post a couple of weeks ago explaining how you can check, you are also more than welcome to reply to that thread and I can check for you as well!
If you're curious if your account has a rotation key or not I've found atproto-browser.vercel.app to be the easiest way to get a "yes or no". Search your handle, and scroll to the rotation key portion. - 2 keys, on bluesky PDS, probably not - 1 key, on a 3rd party PDS, probably not - 3 keys, yeah
What does a Rotation Key look like? Well if you use pdsmoover.com to create one you will get a download file with this text. The PrivateKey is the part to keep safe and is the actual "password". The PublicKey is what shows up on the PLC like in the post above. All tools I know of will label it private something. That's your Rotation Key.
You can use these to recover your account
if it's ever necessary via https://pdsmoover.com/restore.
The restore process will ask for the Private key
KEEP IN A SECURE LOCATION
DID: did:plc:uc7pehijmk5jrllip4cglxdd
PublicKey: did:key:zQ3shg3b8XX4o9ck3Mntb8sHUgZtf6mdr3bdAXCEDkNqvSRRd
PrivateKey: z3vLW5pU6FFnZ7gTCSMv6VuqQufeNFXmzc9LkKvtZCNpKMKT
You can also use pdsmoover.com/restore to recover your account if you ever need to. Even if you don't use the backup service. Just click "Show advance options" and uncheck "Restores files from backup." This will migrate your account to a new PDS with a newly set password and handle if needed. I recommend signing up for the backups as well before it gets to that point, but I made sure PDS MOOver works even if you didn't so you can at least get your account back if you have a Rotation key
Backups
Rotation Keys are only half of the equation for account recovery during an adversarial migration. With it you can move your Bluesky/atproto account to a new PDS. You will be able to login again, make new posts, upload new pictures. But your previous posts, likes, and pictures will be gone. Just like if you didn't keep a backup of your phone. If you lose it or it is stolen, everything on it is gone unless you keep a backup. The same thing happens if your PDS goes down. Your account data is divided up in 3 different things.
Repo - This is your posts, likes, follows, pretty much any thing text related. This is public data
Blobs - This is your pictures, videos, and even the preview pictures of the links you share. This is public data
Preferences - This is things like mutes and the feeds you have saved. This is private data
I wrote the backups feature for pdsmoover.com/backups to hopefully be the easiest way for anyone to have backups of their Bluesky/atproto account. Currently it takes a backup of your Repo and blobs every 6 hrs from sign up automatically and free of charge to users. I do not currently do backups for preferences, but I do have plans in the future to handle this in a secure and private manner. You can think of PDS MOOver backups to be a bit like iCloud, automatic, out of mind, but there when you need it.
There are a few other options for account backups, but only one I know of that allows recovery and restore as well.
bsky.storage from @storacha.network. Similar to PDS MOOver but uses storacha.network as the storage. Offers restore and PLC operations as well
@atbackup.pages.dev from @turtlepaw.on.computer. Backs up stored locally. No restore option from the software, but does secure your data locally
Put it all together
Hopefully after reading this you should now know the importance of having a Rotation Key and keeping regular backups of your data. No one ever wants to use them, but they are important tools to keep your account secure and protect your social identity online from diaster. This wasn't written to be an ad for pdsmoover.com, but I did write the newest update to PDS MOOver to make it easier for anyone to be able to secure their Bluesky/atproto account and be able to recover it if they ever need to. Northsky is also working on very similar tooling for their upcoming migration tool and a good bit of it is avaliable today that works with any PDS as well. No matter how you secure your account, you should. Bluesky and AT Protocol is meant to be future and adversary proof. You own your data, you own your online social identity, and these are all steps to do this. This will let you stand the test of time and protect you and your online social identity from what ever may come in the future.
So. That's what a Rotation Key is.