work done on allow migrations only

gatewip

holy cow it works

working captcha

moved to some config

clean up aisle 10

better flag checking logic hopefully

hbs template

thinking the website works

matches the other captcha

I think it's all working?

rate limit

wrap up hopefully

readme clean up

Cargo.lock

···
 version = 4
 
 [[package]]
+name = "abnf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "087113bd50d9adce24850eed5d0476c7d199d532fce8fab5173650331e09033a"
+dependencies = [
+ "abnf-core",
+ "nom 7.1.3",
+]
+
+[[package]]
+name = "abnf-core"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c44e09c43ae1c368fb91a03a566472d0087c26cf7e1b9e8e289c14ede681dd7d"
+dependencies = [
+ "nom 7.1.3",
+]
+
+[[package]]
 name = "addr2line"
 version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "aliasable"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
+
+[[package]]
 name = "allocator-api2"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
 name = "android_system_properties"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ddb939d66e4ae03cee6091612804ba446b12878410cfa17f785f4dd67d4014e8"
 dependencies = [
+ "flate2",
  "futures-core",
  "memchr",
  "pin-project-lite",
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "base-x"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cbbc9d0964165b47557570cce6c952866c2678457aca742aafc9fb771d30270"
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
+name = "base256emoji"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e9430d9a245a77c92176e649af6e275f20839a48389859d1661e9a128d077c"
+dependencies = [
+ "const-str",
+ "match-lookup",
+]
+
+[[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash",
+ "rustc-hash 1.1.0",
  "shlex",
- "syn",
+ "syn 2.0.105",
  "which",
 ]
 
···
 ]
 
 [[package]]
+name = "bon"
+version = "3.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebeb9aaf9329dff6ceb65c689ca3db33dbf15f324909c60e4e5eef5701ce31b1"
+dependencies = [
+ "bon-macros",
+ "rustversion",
+]
+
+[[package]]
+name = "bon-macros"
+version = "3.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77e9d642a7e3a318e37c2c9427b5a6a48aa1ad55dcd986f3034ab2239045a645"
+dependencies = [
+ "darling 0.21.3",
+ "ident_case",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "borsh"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1da5ab77c1437701eeff7c88d968729e7766172279eab0676857b3d63af7a6f"
+dependencies = [
+ "cfg_aliases",
+]
+
+[[package]]
 name = "bstr"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "btree-range-map"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1be5c9672446d3800bcbcaabaeba121fe22f1fb25700c4562b22faf76d377c33"
+dependencies = [
+ "btree-slab",
+ "cc-traits",
+ "range-traits",
+ "serde",
+ "slab",
+]
+
+[[package]]
+name = "btree-slab"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2b56d3029f075c4fa892428a098425b86cef5c89ae54073137ece416aef13c"
+dependencies = [
+ "cc-traits",
+ "slab",
+ "smallvec",
+]
+
+[[package]]
 name = "bumpalo"
 version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cbor4ii"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544cf8c89359205f4f990d0e6f3828db42df85b5dac95d09157a250eb0749c4"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "cc"
···
 ]
 
 [[package]]
+name = "cc-traits"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "060303ef31ef4a522737e1b1ab68c67916f2a787bb2f4f54f383279adba962b5"
+dependencies = [
+ "slab",
+]
+
+[[package]]
 name = "cexpr"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
 [[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
 name = "chrono"
-version = "0.4.41"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
+checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
+ "serde",
  "wasm-bindgen",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "cid"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3147d8272e8fa0ccd29ce51194dd98f79ddfb8191ba9e3409884e751798acf3a"
+dependencies = [
+ "core2",
+ "multibase",
+ "multihash",
+ "serde",
+ "serde_bytes",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "cipher"
 version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
+name = "const-str"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
+name = "core2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "cpufeatures"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 
 [[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
 name = "crossbeam-queue"
 version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "crypto-common"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core 0.21.3",
+ "darling_macro 0.21.3",
 ]
 
 [[package]]
···
  "proc-macro2",
  "quote",
  "strsim",
- "syn",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core",
+ "darling_core 0.20.11",
  "quote",
- "syn",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core 0.21.3",
+ "quote",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "data-encoding"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+
+[[package]]
+name = "data-encoding-macro"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
+dependencies = [
+ "data-encoding",
+ "data-encoding-macro-internal",
+]
+
+[[package]]
+name = "data-encoding-macro-internal"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
+dependencies = [
+ "data-encoding",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "der"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "deranged"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
 name = "derive_builder"
 version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
 dependencies = [
- "darling",
+ "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
 [[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
 name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "email-encoding"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
 
 [[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
 name = "flume"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "form_urlencoded"
···
 checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
 [[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "futures-sink"
 version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "futures-core",
  "futures-io",
+ "futures-macro",
  "futures-sink",
  "futures-task",
  "memchr",
···
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
···
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasip2",
  "wasm-bindgen",
 ]
 
···
  "aho-corasick",
  "bstr",
  "log",
- "regex-automata 0.4.9",
+ "regex-automata 0.4.13",
  "regex-syntax 0.8.5",
 ]
 
···
  "futures-sink",
  "futures-timer",
  "futures-util",
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "hashbrown 0.15.5",
  "nonzero_ext",
  "parking_lot",
···
 ]
 
 [[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
 name = "h2"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "futures-core",
  "futures-sink",
  "http",
- "indexmap",
+ "indexmap 2.10.0",
  "slab",
  "tokio",
  "tokio-util",
···
 
 [[package]]
 name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
···
 
 [[package]]
 name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
···
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
+name = "hex_fmt"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b07f60793ff0a4d9cef0f18e63b5357e06209987153a64648c972c1e5aff336f"
+
+[[package]]
 name = "hkdf"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
 dependencies = [
  "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.2",
+]
+
+[[package]]
 name = "hyper-timeout"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
 dependencies = [
+ "base64",
  "bytes",
  "futures-channel",
  "futures-core",
···
  "http",
  "http-body",
  "hyper",
+ "ipnet",
  "libc",
+ "percent-encoding",
  "pin-project-lite",
  "socket2",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
 version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.5",
+ "serde",
+]
+
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "inventory"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc61209c082fbeb19919bee74b176221b27223e27b65d781eb91af24eb1fb46e"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
 name = "io-uring"
 version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "ipld-core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "104718b1cc124d92a6d01ca9c9258a7df311405debb3408c445a36452f9bf8db"
+dependencies = [
+ "cid",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+
+[[package]]
+name = "iri-string"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
 name = "itertools"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
+name = "jacquard-api"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbbfd6e2b10fa1731f4d4e40c8f791956b0d4f804fb3efef891afec903f20597"
+dependencies = [
+ "bon",
+ "bytes",
+ "jacquard-common",
+ "jacquard-derive",
+ "jacquard-lexicon",
+ "miette",
+ "rustversion",
+ "serde",
+ "serde_ipld_dagcbor",
+ "thiserror 2.0.14",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "jacquard-common"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df86cb117d9f1c2b0251ba67c3f0e3f963fd22abc6cf8de0e02a7fc846c288ca"
+dependencies = [
+ "base64",
+ "bon",
+ "bytes",
+ "chrono",
+ "cid",
+ "getrandom 0.2.16",
+ "getrandom 0.3.4",
+ "http",
+ "ipld-core",
+ "k256",
+ "langtag",
+ "miette",
+ "multibase",
+ "multihash",
+ "ouroboros",
+ "p256",
+ "rand 0.9.2",
+ "regex",
+ "regex-lite",
+ "reqwest",
+ "serde",
+ "serde_html_form",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "signature",
+ "smol_str",
+ "thiserror 2.0.14",
+ "tokio",
+ "tokio-util",
+ "trait-variant",
+ "url",
+]
+
+[[package]]
+name = "jacquard-derive"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ca61a69dc7aa8fb2d7163416514ff7df5d79f2e8b22e269f4610afa85572fe"
+dependencies = [
+ "heck 0.5.0",
+ "jacquard-lexicon",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "jacquard-identity"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ef714cacebfca486558a9f8e205daf466bfba0466c4d0c450fd6d0252400a53"
+dependencies = [
+ "bon",
+ "bytes",
+ "http",
+ "jacquard-api",
+ "jacquard-common",
+ "jacquard-lexicon",
+ "miette",
+ "percent-encoding",
+ "reqwest",
+ "serde",
+ "serde_html_form",
+ "serde_json",
+ "thiserror 2.0.14",
+ "tokio",
+ "trait-variant",
+ "url",
+ "urlencoding",
+]
+
+[[package]]
+name = "jacquard-lexicon"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de87f2c938faea1b1f1b32d5b9e0c870e7b5bb5efbf96e3692ae2d8f6b2beb7a"
+dependencies = [
+ "cid",
+ "dashmap",
+ "heck 0.5.0",
+ "inventory",
+ "jacquard-common",
+ "miette",
+ "multihash",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "serde_repr",
+ "serde_with",
+ "sha2",
+ "syn 2.0.105",
+ "thiserror 2.0.14",
+ "unicode-segmentation",
+]
+
+[[package]]
 name = "jobserver"
 version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "libc",
 ]
 
 [[package]]
+name = "josekit"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a808e078330e6af222eb0044b71d4b1ff981bfef43e7bc8133a88234e0c86a0c"
+dependencies = [
+ "anyhow",
+ "base64",
+ "flate2",
+ "openssl",
+ "regex",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.14",
+ "time",
+]
+
+[[package]]
 name = "js-sys"
 version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "sha2",
+]
+
+[[package]]
+name = "langtag"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ecb4c689a30e48ebeaa14237f34037e300dd072e6ad21a9ec72e810ff3c6600"
+dependencies = [
+ "serde",
+ "static-regular-grammar",
+ "thiserror 1.0.69",
+]
+
+[[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "match-lookup"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1265724d8cb29dbbc2b0f06fffb8bf1a8c0cf73a78eede9ba73a4a66c52a981e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
 name = "matchers"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
+name = "miette"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7"
+dependencies = [
+ "cfg-if",
+ "miette-derive",
+ "unicode-width",
+]
+
+[[package]]
+name = "miette-derive"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
···
 checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
+name = "multibase"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8694bb4835f452b0e3bb06dbebb1d6fc5385b6ca1caf2e55fd165c042390ec77"
+dependencies = [
+ "base-x",
+ "base256emoji",
+ "data-encoding",
+ "data-encoding-macro",
+]
+
+[[package]]
+name = "multihash"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b430e7953c29dd6a09afc29ff0bb69c6e306329ee6794700aee27b76a1aea8d"
+dependencies = [
+ "core2",
+ "serde",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
 name = "num-integer"
 version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
+name = "openssl"
+version = "0.10.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "ouroboros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0f050db9c44b97a94723127e6be766ac5c340c48f2c4bb3ffa11713744be59"
+dependencies = [
+ "aliasable",
+ "ouroboros_macro",
+ "static_assertions",
+]
+
+[[package]]
+name = "ouroboros_macro"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c7028bdd3d43083f6d8d4d5187680d0d3560d54df4cc9d752005268b41e64d0"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "dotenvy",
  "handlebars",
  "hex",
+ "html-escape",
  "hyper-util",
+ "jacquard-common",
+ "jacquard-identity",
+ "josekit",
  "jwt-compact",
  "lettre",
+ "multibase",
  "rand 0.9.2",
+ "reqwest",
  "rust-embed",
  "rustls",
  "scrypt",
···
  "tower_governor",
  "tracing",
  "tracing-subscriber",
+ "urlencoding",
 ]
 
 [[package]]
···
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
 name = "ppv-lite86"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
 dependencies = [
  "proc-macro2",
- "syn",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+ "version_check",
+ "yansi",
+]
+
+[[package]]
 name = "psm"
 version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "libc",
  "once_cell",
  "raw-cpuid",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "web-sys",
  "winapi",
 ]
 
 [[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.14",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.14",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "quote"
 version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
 ]
+
+[[package]]
+name = "range-traits"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d20581732dd76fa913c7dff1a2412b714afe3573e94d41c34719de73337cc8ab"
 
 [[package]]
 name = "raw-cpuid"
···
 ]
 
 [[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.9",
+ "regex-automata 0.4.13",
  "regex-syntax 0.8.5",
 ]
 
···
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
···
 ]
 
 [[package]]
+name = "regex-lite"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d942b98df5e658f56f20d592c7f868833fe38115e65c33003d8cd224b0155da"
+
+[[package]]
 name = "regex-syntax"
 version = "0.6.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
+name = "reqwest"
+version = "0.12.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
+dependencies = [
+ "async-compression",
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "webpki-roots 1.0.2",
+]
+
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
+[[package]]
 name = "ring"
 version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "proc-macro2",
  "quote",
  "rust-embed-utils",
- "syn",
+ "syn 2.0.105",
  "walkdir",
 ]
 
···
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
 name = "rustix"
 version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
···
 ]
 
 [[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9558e172d4e8533736ba97870c4b2cd63f84b382a3d6eb063da41b91cce17289"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "pbkdf2",
  "salsa20",
  "sha2",
+]
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "serde_html_form"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2f2d7ff8a2140333718bb329f5c40fc5f0865b84c426183ce14c97d2ab8154f"
+dependencies = [
+ "form_urlencoded",
+ "indexmap 2.10.0",
+ "itoa",
+ "ryu",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_ipld_dagcbor"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46182f4f08349a02b45c998ba3215d3f9de826246ba02bb9dddfe9a2a2100778"
+dependencies = [
+ "cbor4ii",
+ "ipld-core",
+ "scopeguard",
+ "serde",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.142"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "030fedb782600dcbd6f02d479bf0d817ac3bb40d644745b769d6a96bc3afc5a7"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
+ "indexmap 2.10.0",
  "itoa",
  "memchr",
  "ryu",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_with"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10574371d41b0d9b2cff89418eda27da52bcaff2cc8741db26382a77c29131f1"
+dependencies = [
+ "base64",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.10.0",
+ "schemars 0.9.0",
+ "schemars 1.1.0",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a72d8216842fdd57820dc78d840bef99248e35fb2554ff923319e60f2d686b"
+dependencies = [
+ "darling 0.21.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "sha1"
 version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
 name = "slab"
 version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "smol_str"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3498b0a27f93ef1402f20eefacfaa1691272ac4eca1cdc8c596cb0a245d6cbf5"
+dependencies = [
+ "borsh",
+ "serde_core",
+]
+
+[[package]]
 name = "socket2"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "futures-util",
  "hashbrown 0.15.5",
  "hashlink",
- "indexmap",
+ "indexmap 2.10.0",
  "log",
  "memchr",
  "once_cell",
···
  "quote",
  "sqlx-core",
  "sqlx-macros-core",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "dotenvy",
  "either",
- "heck",
+ "heck 0.5.0",
  "hex",
  "once_cell",
  "proc-macro2",
···
  "sqlx-mysql",
  "sqlx-postgres",
  "sqlx-sqlite",
- "syn",
+ "syn 2.0.105",
  "tokio",
  "url",
 ]
···
 ]
 
 [[package]]
+name = "static-regular-grammar"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f4a6c40247579acfbb138c3cd7de3dab113ab4ac6227f1b7de7d626ee667957"
+dependencies = [
+ "abnf",
+ "btree-range-map",
+ "ciborium",
+ "hex_fmt",
+ "indoc",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "sha2",
+ "syn 2.0.105",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
 name = "stringprep"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 
 [[package]]
 name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
 version = "2.0.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7bc3fcb250e53458e712715cf74285c1f889686520d79294a9ef3bd7aa1fc619"
···
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
 
 [[package]]
 name = "synstructure"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "time"
+version = "0.3.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+
+[[package]]
+name = "time-macros"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
 name = "tinystr"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "tokio-util"
-version = "0.7.15"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
 dependencies = [
  "bytes",
  "futures-core",
···
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap",
+ "indexmap 2.10.0",
  "pin-project-lite",
  "slab",
  "sync_wrapper",
···
  "bitflags",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
+ "iri-string",
  "pin-project-lite",
  "tokio",
  "tokio-util",
+ "tower",
  "tower-layer",
  "tower-service",
 ]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "trait-variant"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70977707304198400eb4835a78f6a9f928bf41bba420deb8fdb175cd965d77a7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.105",
+]
+
+[[package]]
 name = "try-lock"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
 
 [[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unsigned-varint"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
+
+[[package]]
 name = "untrusted"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "form_urlencoded",
  "idna",
  "percent-encoding",
+ "serde",
 ]
 
 [[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "utf8-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+
+[[package]]
 name = "utf8_iter"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
 dependencies = [
- "wit-bindgen-rt",
+ "wit-bindgen",
 ]
 
 [[package]]
···
  "log",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
···
 checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
 dependencies = [
  "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
 ]
 
 [[package]]
···
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
+ "windows-link 0.1.3",
  "windows-result",
  "windows-strings",
 ]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
 name = "windows-result"
 version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
···
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
+name = "wit-bindgen"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags",
-]
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "writeable"
···
 checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
 
 [[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
 name = "yoke"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
  "synstructure",
 ]
 
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
  "synstructure",
 ]
 
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.105",
 ]
 
 [[package]]

Cargo.toml

···
 axum-template = { version = "3.0.0", features = ["handlebars"] }
 rand = "0.9.2"
 anyhow = "1.0.99"
-chrono = "0.4.41"
+chrono = { version = "0.4.42", features = ["default", "serde"] }
 sha2 = "0.10"
+jacquard-common = "0.9.2"
+jacquard-identity = "0.9.2"
+multibase = "0.9.2"
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+urlencoding = "2.1"
+html-escape = "0.2.13"
+josekit = "0.10.3"

README.md

···
 - Overrides The login endpoint to add 2FA for both Bluesky client logged in and OAuth logins
 - Overrides the settings endpoints as well. As long as you have a confirmed email you can turn on 2FA
 
-## Captcha on Create Account
+## Captcha on account creation
+
+Require a `verificationCode` set on the `createAccount` request. This is gotten from completing a captcha challenge
+hosted on the
+PDS mimicking what the Bluesky Entryway does. Migration tools will need to support this, but social-apps will support
+and redirect to `GATEKEEPER_DEFAULT_CAPTCHA_REDIRECT`. This is how the clients know to get the code to prove a captcha
+was successful.
+
+- Requires `GATEKEEPER_CREATE_ACCOUNT_CAPTCHA` to be set to true.
+- Requires `PDS_HCAPTCHA_SITE_KEY` and `PDS_HCAPTCHA_SECRET_KEY` to be set. Can sign up at https://www.hcaptcha.com/
+- Requires proxying `/xrpc/com.atproto.server.describeServer`, `/xrpc/com.atproto.server.createAccount` and `/gate/*` to
+  PDS
+  Gatekeeper
+- Optional `GATEKEEPER_JWE_KEY` key to encrypt the captcha verification code. Defaults to a random 32 byte key. Not
+  strictly needed unless you're scaling
+- Optional`GATEKEEPER_DEFAULT_CAPTCHA_REDIRECT` default redirect on captcha success. Defaults to `https://bsky.app`.
+- Optional `GATEKEEPER_CAPTCHA_SUCCESS_REDIRECTS` allowed redirect urls for captcha success. You want these to match the
+  url showing the captcha. Defaults are:
+    - https://bsky.app
+    - https://pdsmoover.com
+    - https://blacksky.community
+    - https://tektite.cc
+
+## Block account creation unless it's a migration
 
-Future feature?
+You can set `GATEKEEPER_ALLOW_ONLY_MIGRATIONS` to block createAccount unless it's via a migration. This does not require
+a change for migration tools, but social-apps create a new account will no longer work and to create a brand new account
+users will need to do this via the Oauth account create screen on the PDS. We recommend setting `PDS_HCAPTCHA_SITE_KEY`
+and `PDS_HCAPTCHA_SECRET_KEY` so the OAuth screen is protected by a captcha if you use this with invite codes turned
+off.
 
 # Setup
 
···
       - pds
 ```
 
-For Coolify, if you're using Traefik as your proxy you'll need to make sure the labels for the container are set up correctly. A full example can be found at [./examples/coolify-compose.yml](./examples/coolify-compose.yml).
+For Coolify, if you're using Traefik as your proxy you'll need to make sure the labels for the container are set up
+correctly. A full example can be found at [./examples/coolify-compose.yml](./examples/coolify-compose.yml).
 
 ```yml
 gatekeeper:
-    container_name: gatekeeper
-    image: 'fatfingers23/pds_gatekeeper:latest'
-    restart: unless-stopped
-    volumes:
-      - '/pds:/pds'
-    environment:
-      - 'PDS_DATA_DIRECTORY=${PDS_DATA_DIRECTORY:-/pds}'
-      - 'PDS_BASE_URL=http://pds:3000'
-      - GATEKEEPER_HOST=0.0.0.0
-    depends_on:
-      - pds
-    healthcheck:
-      test:
-        - CMD
-        - timeout
-        - '1'
-        - bash
-        - '-c'
-        - 'cat < /dev/null > /dev/tcp/0.0.0.0/8080'
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    labels:
-      - traefik.enable=true
-      - 'traefik.http.routers.pds-gatekeeper.rule=Host(`yourpds.com`) && (Path(`/xrpc/com.atproto.server.getSession`) || Path(`/xrpc/com.atproto.server.updateEmail`) || Path(`/xrpc/com.atproto.server.createSession`) || Path(`/xrpc/com.atproto.server.createAccount`) || Path(`/@atproto/oauth-provider/~api/sign-in`))'
-      - traefik.http.routers.pds-gatekeeper.entrypoints=https
-      - traefik.http.routers.pds-gatekeeper.tls=true
-      - traefik.http.routers.pds-gatekeeper.priority=100
-      - traefik.http.routers.pds-gatekeeper.middlewares=gatekeeper-cors
-      - traefik.http.services.pds-gatekeeper.loadbalancer.server.port=8080
-      - traefik.http.services.pds-gatekeeper.loadbalancer.server.scheme=http
-      - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowmethods=GET,POST,PUT,DELETE,OPTIONS,PATCH'
-      - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowheaders=*'
-      - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolalloworiginlist=*'
-      - traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolmaxage=100
-      - traefik.http.middlewares.gatekeeper-cors.headers.addvaryheader=true
-      - traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowcredentials=true
+  container_name: gatekeeper
+  image: 'fatfingers23/pds_gatekeeper:latest'
+  restart: unless-stopped
+  volumes:
+    - '/pds:/pds'
+  environment:
+    - 'PDS_DATA_DIRECTORY=${PDS_DATA_DIRECTORY:-/pds}'
+    - 'PDS_BASE_URL=http://pds:3000'
+    - GATEKEEPER_HOST=0.0.0.0
+  depends_on:
+    - pds
+  healthcheck:
+    test:
+      - CMD
+      - timeout
+      - '1'
+      - bash
+      - '-c'
+      - 'cat < /dev/null > /dev/tcp/0.0.0.0/8080'
+    interval: 10s
+    timeout: 5s
+    retries: 3
+    start_period: 10s
+  labels:
+    - traefik.enable=true
+    - 'traefik.http.routers.pds-gatekeeper.rule=Host(`yourpds.com`) && (Path(`/xrpc/com.atproto.server.getSession`) || Path(`/xrpc/com.atproto.server.updateEmail`) || Path(`/xrpc/com.atproto.server.createSession`) || Path(`/xrpc/com.atproto.server.createAccount`) || Path(`/@atproto/oauth-provider/~api/sign-in`))'
+    - traefik.http.routers.pds-gatekeeper.entrypoints=https
+    - traefik.http.routers.pds-gatekeeper.tls=true
+    - traefik.http.routers.pds-gatekeeper.priority=100
+    - traefik.http.routers.pds-gatekeeper.middlewares=gatekeeper-cors
+    - traefik.http.services.pds-gatekeeper.loadbalancer.server.port=8080
+    - traefik.http.services.pds-gatekeeper.loadbalancer.server.scheme=http
+    - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowmethods=GET,POST,PUT,DELETE,OPTIONS,PATCH'
+    - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowheaders=*'
+    - 'traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolalloworiginlist=*'
+    - traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolmaxage=100
+    - traefik.http.middlewares.gatekeeper-cors.headers.addvaryheader=true
+    - traefik.http.middlewares.gatekeeper-cors.headers.accesscontrolallowcredentials=true
 ```
 
 ## Caddy setup
···
 in extra functionality. The main part is below, for a full example see [./examples/Caddyfile](./examples/Caddyfile).
 This is usually found at `/pds/caddy/etc/caddy/Caddyfile` on your PDS.
 
-```caddyfile
+```
     @gatekeeper {
-            path /xrpc/com.atproto.server.getSession
-            path /xrpc/com.atproto.server.updateEmail
-            path /xrpc/com.atproto.server.createSession
-            path /xrpc/com.atproto.server.createAccount
-            path /@atproto/oauth-provider/~api/sign-in
+                path /xrpc/com.atproto.server.getSession
+                path /xrpc/com.atproto.server.describeServer
+                path /xrpc/com.atproto.server.updateEmail
+                path /xrpc/com.atproto.server.createSession
+                path /xrpc/com.atproto.server.createAccount
+                path /@atproto/oauth-provider/~api/sign-in
+                path /gate/*
     }
 
     handle @gatekeeper {
-            reverse_proxy http://localhost:8080
-    }
+       reverse_proxy http://localhost:8080
+   }
 
-    reverse_proxy http://localhost:3000
+   reverse_proxy http://localhost:3000
 ```
 
 If you use a cloudflare tunnel then your caddyfile would look a bit more like below with your tunnel proxying to
 `localhost:8081` (or w/e port you want).
 
-```caddyfile
+```
 http://*.localhost:8082, http://localhost:8082 {
-        @gatekeeper {
-                path /xrpc/com.atproto.server.getSession
-                path /xrpc/com.atproto.server.updateEmail
-                path /xrpc/com.atproto.server.createSession
-                path /xrpc/com.atproto.server.createAccount
-                path /@atproto/oauth-provider/~api/sign-in
-        }
+    @gatekeeper {
+        path /xrpc/com.atproto.server.getSession
+        path /xrpc/com.atproto.server.describeServer
+        path /xrpc/com.atproto.server.updateEmail
+        path /xrpc/com.atproto.server.createSession
+        path /xrpc/com.atproto.server.createAccount
+        path /@atproto/oauth-provider/~api/sign-in
+        path /gate/*
+    }
 
-        handle @gatekeeper {
-                reverse_proxy http://localhost:8080 {
-                #Makes sure the cloudflare ip is proxied and able to be picked up by pds gatekeeper
-			    header_up X-Forwarded-For {http.request.header.CF-Connecting-IP}
-		    }
-        }
-
-        reverse_proxy http://localhost:3000
+    handle @gatekeeper {
+             #This is the address for PDS gatekeeper, default is 8080
+             reverse_proxy http://localhost:8080
+             #Makes sure the cloudflare ip is proxied and able to be picked up by pds gatekeeper
+             header_up X-Forwarded-For {http.request.header.CF-Connecting-IP}
+    }
+    reverse_proxy http://localhost:3000
 }
 
 ```
···
 
 `GATEKEEPER_CREATE_ACCOUNT_BURST` - Sets how many requests can be made in a burst. In the prior example this is where
 the 5 comes from. Example can set this to 10 to allow for 10 requests in a burst, and after 60 seconds it will drop one
-off. 
+off.
+
+`GATEKEEPER_ALLOW_ONLY_MIGRATIONS` - Defaults false. If set to true, will only allow the
+`/xrpc/com.atproto.server.createAccount` endpoint to be used for migrations. Meaning it will check for the serviceAuth
+token and verify it is valid.
+

examples/Caddyfile

···
 {
-        email [e-mail]
-        on_demand_tls {
-                ask http://localhost:3000/tls-check
-        }
+    email [e-mail]
+    on_demand_tls {
+                      ask http://localhost:3000/tls-check
+                  }
 }
 
 *.yourpds.com, yourpds.com {
-        tls {
-                on_demand
-        }
-        # You'll most likely just want from here to....
-        @gatekeeper {
-                path /xrpc/com.atproto.server.getSession
-                path /xrpc/com.atproto.server.updateEmail
-                path /xrpc/com.atproto.server.createSession
-                path /xrpc/com.atproto.server.createAccount
-                path /@atproto/oauth-provider/~api/sign-in
+    tls {
+            on_demand
         }
+# You'll most likely just want from here to....
+    @gatekeeper {
+                    path /xrpc/com.atproto.server.getSession
+                    path /xrpc/com.atproto.server.describeServer
+                    path /xrpc/com.atproto.server.updateEmail
+                    path /xrpc/com.atproto.server.createSession
+                    path /xrpc/com.atproto.server.createAccount
+                    path /@atproto/oauth-provider/~api/sign-in
+                    path /gate/*
+                }
 
-        handle @gatekeeper {
-                #This is the address for PDS gatekeeper, default is 8080
-                reverse_proxy http://localhost:8080
-        }
+    handle @gatekeeper {
+                       #This is the address for PDS gatekeeper, default is 8080
+                           reverse_proxy http://localhost:8080
+                       }
 
-        reverse_proxy http://localhost:3000
-        #..here. Copy and paste this replacing the reverse_proxy http://localhost:3000 line
+    reverse_proxy http://localhost:3000
+#..here. Copy and paste this replacing the reverse_proxy http://localhost:3000 line
 }
-
-

examples/coolify-compose.yml

···
       start_period: 10s
     labels:
       - traefik.enable=true
-      - 'traefik.http.routers.pds-gatekeeper.rule=Host(`yourpds.com`) && (Path(`/xrpc/com.atproto.server.getSession`) || Path(`/xrpc/com.atproto.server.updateEmail`) || Path(`/xrpc/com.atproto.server.createSession`) || Path(`/xrpc/com.atproto.server.createAccount`) || Path(`/@atproto/oauth-provider/~api/sign-in`))'
+      - 'traefik.http.routers.pds-gatekeeper.rule=Host(`yourpds.com`) && (Path(`/xrpc/com.atproto.server.getSession`) || Path(`/xrpc/com.atproto.server.describeServer`) || Path(`/xrpc/com.atproto.server.updateEmail`) || Path(`/xrpc/com.atproto.server.createSession`) || Path(`/xrpc/com.atproto.server.createAccount`) || Path(`/@atproto/oauth-provider/~api/sign-in`) || Path(`/gate`))'
       - traefik.http.routers.pds-gatekeeper.entrypoints=https
       - traefik.http.routers.pds-gatekeeper.tls=true
       - traefik.http.routers.pds-gatekeeper.priority=100

html_templates/captcha.hbs

···
+<html lang="en" class=" ">
+<head>
+    <meta charset="utf-8"/>
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"
+    />
+    <meta name="referrer" content="origin-when-cross-origin"/>
+
+    <title>
+        {{pds}} - Captcha
+    </title>
+    <style>
+        :root,
+        :root.light-mode {
+            --brand-color: rgb(16, 131, 254);
+            --primary-color: rgb(7, 10, 13);
+            --secondary-color: rgb(66, 86, 108);
+            --bg-primary-color: rgb(255, 255, 255);
+            --bg-secondary-color: rgb(240, 242, 245);
+        }
+
+        @media (prefers-color-scheme: dark) {
+            :root {
+                --brand-color: rgb(16, 131, 254);
+                --primary-color: rgb(255, 255, 255);
+                --secondary-color: rgb(133, 152, 173);
+                --bg-primary-color: rgb(7, 10, 13);
+                --bg-secondary-color: rgb(13, 18, 23);
+            }
+        }
+
+        :root.dark-mode {
+            --brand-color: rgb(16, 131, 254);
+            --primary-color: rgb(255, 255, 255);
+            --secondary-color: rgb(133, 152, 173);
+            --bg-primary-color: rgb(7, 10, 13);
+            --bg-secondary-color: rgb(13, 18, 23);
+        }
+
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica,
+            Arial, sans-serif;
+            background: var(--bg-primary-color);
+            color: var(--primary-color);
+            text-rendering: optimizeLegibility;
+            -webkit-font-smoothing: antialiased;
+        }
+
+        .info {
+            border-radius: 8px;
+            padding: 12px 14px;
+            letter-spacing: 0.25px;
+            font-weight: 400;
+            background-color: var(--bg-secondary-color);
+            color: var(--secondary-color);
+        }
+
+        .gate-page,
+        .error-page {
+            margin: 0;
+            margin-top: 10px;
+            display: flex;
+            justify-content: center;
+        }
+
+        .gate-page .main,
+        .error-page .main {
+            max-width: 600px;
+            width: 100%;
+            display: flex;
+            flex-direction: column;
+        }
+
+        .gate-page .main {
+            padding: 0;
+        }
+
+        .error-page .main {
+            padding: 20px;
+        }
+
+        .gate-page .main > :not(:first-child),
+        .error-page .main > :not(:first-child) {
+            margin-top: 20px;
+        }
+
+        .gate-page #gate-form {
+            margin: 0;
+        }
+
+        .gate-page #hcaptcha {
+            display: flex;
+            justify-content: center;
+        }
+
+        .pds-title {
+            font-size: 2.25rem;
+            font-weight: 700;
+            line-height: 1.2;
+            text-align: center;
+            color: var(--primary-color);
+            margin: 10px 0 16px;
+        }
+
+    </style>
+
+    <script type="text/javascript">
+        function onCaptchaReady() {
+            const theme = document.documentElement.classList.contains('dark-mode') ?
+                    'dark' :
+                    document.documentElement.classList.contains('light-mode') ?
+                            'light' :
+                            window.matchMedia('(prefers-color-scheme: dark)').matches ?
+                                    'dark' :
+                                    'light'
+            hcaptcha.render('hcaptcha', {theme});
+        }
+
+        function onCaptchaComplete() {
+            setTimeout(function () {
+                document.getElementById('gate-form').submit();
+            }, 1000);
+        }
+
+        function onCaptchaError() {
+            const url = new URL(location.href);
+            url.searchParams.set('error', 'true');
+            location.assign(url.search);
+        }
+
+        function onCaptchaExpired() {
+            const url = new URL(location.href);
+            url.searchParams.set('error', 'expired');
+            location.assign(url.search);
+        }
+    </script>
+    <script
+            src="https://js.hcaptcha.com/1/api.js?render=explicit&onload=onCaptchaReady"
+            async
+            defer
+    ></script>
+    <link rel="stylesheet" href="/gate/signup/assets/common.css"/>
+</head>
+
+<body class="gate-page">
+<div class="main">
+    <div class="pds-title">{{pds}}</div>
+    <form id="gate-form" action="" method="POST">
+        <div
+                id="hcaptcha"
+                data-sitekey="{{captcha_site_key}}"
+                data-callback="onCaptchaComplete"
+                data-error-callback="onCaptchaError"
+                data-expired-callback="onCaptchaExpired"
+                data-chalexpired-callback="onCaptchaExpired"
+        ></div>
+        <input type="hidden" name="redirect_url" value="{{redirect_url}}"/>
+    </form>
+    {{#if error_message }}
+        <div class="info">{{error_message}}</div>
+    {{/if}}
+
+</div>
+</body>
+</html>

justfile

···
     docker buildx build \
             --platform linux/arm64,linux/amd64 \
             --tag fatfingers23/pds_gatekeeper:latest \
-            --tag fatfingers23/pds_gatekeeper:0.1.0.3 \
+            --tag fatfingers23/pds_gatekeeper:0.1.0.5 \
             --push .

migrations/20251126000000_gate_codes.sql

···
+-- Add migration script here
+CREATE TABLE IF NOT EXISTS gate_codes
+(
+    code VARCHAR PRIMARY KEY,
+    handle VARCHAR NOT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Index on created_at for efficient cleanup of expired codes
+CREATE INDEX IF NOT EXISTS idx_gate_codes_created_at ON gate_codes(created_at);

src/gate.rs

···
+use crate::AppState;
+use crate::helpers::{generate_gate_token, json_error_response};
+use axum::Form;
+use axum::extract::{Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_template::RenderHtml;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::env;
+use tracing::log;
+
+#[derive(Deserialize)]
+pub struct GateQuery {
+    handle: String,
+    state: String,
+    #[serde(default)]
+    error: Option<String>,
+    #[serde(default)]
+    redirect_url: Option<String>,
+}
+
+#[derive(Deserialize, Serialize)]
+pub struct CaptchaPage {
+    handle: String,
+    state: String,
+    captcha_site_key: String,
+    error_message: Option<String>,
+    pds: String,
+    redirect_url: Option<String>,
+}
+
+#[derive(Deserialize)]
+pub struct CaptchaForm {
+    #[serde(rename = "h-captcha-response")]
+    h_captcha_response: String,
+    #[serde(default)]
+    redirect_url: Option<String>,
+}
+
+/// GET /gate - Display the captcha page
+pub async fn get_gate(
+    Query(params): Query<GateQuery>,
+    State(state): State<AppState>,
+) -> impl IntoResponse {
+    let hcaptcha_site_key = match env::var("PDS_HCAPTCHA_SITE_KEY") {
+        Ok(key) => key,
+        Err(_) => {
+            return json_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "ServerError",
+                "hCaptcha is not configured",
+            )
+            .unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response());
+        }
+    };
+
+    let error_message = match params.error {
+        None => None,
+        Some(error) => Some(html_escape::encode_safe(&error).to_string()),
+    };
+
+    RenderHtml(
+        "captcha.hbs",
+        state.template_engine,
+        CaptchaPage {
+            handle: params.handle,
+            state: params.state,
+            captcha_site_key: hcaptcha_site_key,
+            error_message,
+            pds: state.app_config.pds_service_did.replace("did:web:", ""),
+            redirect_url: params.redirect_url,
+        },
+    )
+    .into_response()
+}
+
+/// POST /gate - Verify captcha and redirect
+pub async fn post_gate(
+    State(state): State<AppState>,
+    Query(params): Query<GateQuery>,
+    Form(form): Form<CaptchaForm>,
+) -> Response {
+    // Verify hCaptcha response
+    let hcaptcha_secret = match env::var("PDS_HCAPTCHA_SECRET_KEY") {
+        Ok(secret) => secret,
+        Err(_) => {
+            return json_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "ServerError",
+                "hCaptcha is not configured",
+            )
+            .unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response());
+        }
+    };
+
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(10))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            log::error!("Failed to create HTTP client: {}", e);
+            return json_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "ServerError",
+                "Failed to verify captcha",
+            )
+            .unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response());
+        }
+    };
+
+    #[derive(Deserialize, Serialize)]
+    struct HCaptchaResponse {
+        success: bool,
+        challenge_ts: DateTime<Utc>,
+        hostname: String,
+        #[serde(rename = "error-codes", default)]
+        error_codes: Vec<String>,
+    }
+
+    let verification_result = client
+        .post("https://api.hcaptcha.com/siteverify")
+        .form(&[
+            ("secret", hcaptcha_secret.as_str()),
+            ("response", form.h_captcha_response.as_str()),
+        ])
+        .send()
+        .await;
+
+    let verification_response = match verification_result {
+        Ok(resp) => resp,
+        Err(e) => {
+            log::error!("Failed to verify hCaptcha: {}", e);
+
+            return Redirect::to(&format!(
+                "/gate?handle={}&state={}&error={}",
+                url_encode(&params.handle),
+                url_encode(&params.state),
+                url_encode("Verification failed. Please try again.")
+            ))
+            .into_response();
+        }
+    };
+
+    let captcha_result: HCaptchaResponse = match verification_response.json().await {
+        Ok(result) => result,
+        Err(e) => {
+            log::error!("Failed to parse hCaptcha response: {}", e);
+
+            return Redirect::to(&format!(
+                "/gate?handle={}&state={}&error={}",
+                url_encode(&params.handle),
+                url_encode(&params.state),
+                url_encode("Verification failed. Please try again.")
+            ))
+            .into_response();
+        }
+    };
+
+    if !captcha_result.success {
+        log::warn!(
+            "hCaptcha verification failed for handle {}: {:?}",
+            params.handle,
+            captcha_result.error_codes
+        );
+        return Redirect::to(&format!(
+            "/gate?handle={}&state={}&error={}",
+            url_encode(&params.handle),
+            url_encode(&params.state),
+            url_encode("Verification failed. Please try again.")
+        ))
+        .into_response();
+    }
+
+    // Generate secure JWE verification token
+    let code = match generate_gate_token(&params.handle, &state.app_config.gate_jwe_key) {
+        Ok(token) => token,
+        Err(e) => {
+            log::error!("Failed to generate gate token: {}", e);
+            return json_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "ServerError",
+                "Failed to create verification code",
+            )
+            .unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response());
+        }
+    };
+
+    let now = Utc::now();
+
+    // Store the encrypted token in the database
+    let result = sqlx::query(
+        "INSERT INTO gate_codes (code, handle, created_at)
+         VALUES (?, ?, ?)",
+    )
+    .bind(&code)
+    .bind(&params.handle)
+    .bind(now)
+    .execute(&state.pds_gatekeeper_pool)
+    .await;
+
+    if let Err(e) = result {
+        log::error!("Failed to store gate code: {}", e);
+        return json_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "ServerError",
+            "Failed to create verification code",
+        )
+        .unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response());
+    }
+
+    // Redirects by origin if it's found. If not redirect to the configured URL.
+    let mut base_redirect = state.app_config.default_successful_redirect_url.clone();
+    if let Some(ref redirect_url) = form.redirect_url {
+        let trimmed = redirect_url.trim();
+        if !trimmed.is_empty()
+            && (trimmed.starts_with("https://") || trimmed.starts_with("http://"))
+        {
+            base_redirect = trimmed.trim_end_matches('/').to_string();
+        }
+    }
+
+    let base_redirect = match state
+        .app_config
+        .captcha_success_redirects
+        .contains(&base_redirect)
+    {
+        true => base_redirect,
+        false => state.app_config.default_successful_redirect_url.clone(),
+    };
+
+    // Redirect to client app with code and state
+    let redirect_url = format!(
+        "{}/?code={}&state={}",
+        base_redirect,
+        url_encode(&code),
+        url_encode(&params.state)
+    );
+
+    Redirect::to(&redirect_url).into_response()
+}
+
+/// Simple URL encode function
+fn url_encode(s: &str) -> String {
+    urlencoding::encode(s).to_string()
+}

src/helpers.rs

···
 use crate::AppState;
 use crate::helpers::TokenCheckError::InvalidToken;
 use anyhow::anyhow;
-use axum::body::{Body, to_bytes};
-use axum::extract::Request;
-use axum::http::header::CONTENT_TYPE;
-use axum::http::{HeaderMap, StatusCode, Uri};
-use axum::response::{IntoResponse, Response};
+use axum::{
+    body::{Body, to_bytes},
+    extract::Request,
+    http::header::CONTENT_TYPE,
+    http::{HeaderMap, StatusCode, Uri},
+    response::{IntoResponse, Response},
+};
 use axum_template::TemplateEngine;
 use chrono::Utc;
-use lettre::message::{MultiPart, SinglePart, header};
-use lettre::{AsyncTransport, Message};
+use jacquard_common::{
+    service_auth, service_auth::PublicKey, types::did::Did, types::did_doc::VerificationMethod,
+    types::nsid::Nsid,
+};
+use jacquard_identity::{PublicResolver, resolver::IdentityResolver};
+use josekit::jwe::alg::direct::DirectJweAlgorithm;
+use lettre::{
+    AsyncTransport, Message,
+    message::{MultiPart, SinglePart, header},
+};
 use rand::Rng;
 use serde::de::DeserializeOwned;
 use serde_json::{Map, Value};
 use sha2::{Digest, Sha256};
 use sqlx::SqlitePool;
-use std::env;
+use std::sync::Arc;
 use tracing::{error, log};
 
 ///Used to generate the email 2fa code
···
 where
     T: DeserializeOwned,
 {
-    let uri = format!("{}{}", state.pds_base_url, path);
+    let uri = format!("{}{}", state.app_config.pds_base_url, path);
     *req.uri_mut() = Uri::try_from(uri).map_err(|_| StatusCode::BAD_REQUEST)?;
 
     let result = state
···
                     let email_body = state
                         .template_engine
                         .render("two_factor_code.hbs", email_data)?;
-                    let email_subject = env::var("GATEKEEPER_TWO_FACTOR_EMAIL_SUBJECT")
-                        .unwrap_or("Sign in to Bluesky".to_string());
 
                     let email_message = Message::builder()
                         //TODO prob get the proper type in the state
-                        .from(state.mailer_from.parse()?)
+                        .from(state.app_config.mailer_from.parse()?)
                         .to(email.parse()?)
-                        .subject(email_subject)
+                        .subject(&state.app_config.email_subject)
                         .multipart(
                             MultiPart::alternative() // This is composed of two parts.
                                 .singlepart(
···
 
     format!("{masked_local}@{masked_domain}")
 }
+
+pub enum VerifyServiceAuthError {
+    AuthFailed,
+    Error(anyhow::Error),
+}
+
+/// Verifies the service auth token that is appended to an XRPC proxy request
+pub async fn verify_service_auth(
+    jwt: &str,
+    lxm: &Nsid<'static>,
+    public_resolver: Arc<PublicResolver>,
+    service_did: &Did<'static>,
+    //The did of the user wanting to create an account
+    requested_did: &Did<'static>,
+) -> Result<(), VerifyServiceAuthError> {
+    let parsed =
+        service_auth::parse_jwt(jwt).map_err(|e| VerifyServiceAuthError::Error(e.into()))?;
+
+    let claims = parsed.claims();
+
+    let did_doc = public_resolver
+        .resolve_did_doc(&requested_did)
+        .await
+        .map_err(|err| {
+            log::error!("Error resolving the service auth for: {}", claims.iss);
+            return VerifyServiceAuthError::Error(err.into());
+        })?;
+
+    // Parse the DID document response to get verification methods
+    let doc = did_doc.parse().map_err(|err| {
+        log::error!("Error parsing the service auth did doc: {}", claims.iss);
+        VerifyServiceAuthError::Error(anyhow::anyhow!(err))
+    })?;
+
+    let verification_methods = doc.verification_method.as_deref().ok_or_else(|| {
+        VerifyServiceAuthError::Error(anyhow::anyhow!(
+            "No verification methods in did doc: {}",
+            &claims.iss
+        ))
+    })?;
+
+    let signing_key = extract_signing_key(verification_methods).ok_or_else(|| {
+        VerifyServiceAuthError::Error(anyhow::anyhow!(
+            "No signing key found in did doc: {}",
+            &claims.iss
+        ))
+    })?;
+
+    service_auth::verify_signature(&parsed, &signing_key).map_err(|err| {
+        log::error!("Error verifying service auth signature: {}", err);
+        VerifyServiceAuthError::AuthFailed
+    })?;
+
+    // Now validate claims (audience, expiration, etc.)
+    claims.validate(service_did).map_err(|e| {
+        log::error!("Error validating service auth claims: {}", e);
+        VerifyServiceAuthError::AuthFailed
+    })?;
+
+    if claims.aud != *service_did {
+        log::error!("Invalid audience (did:web): {}", claims.aud);
+        return Err(VerifyServiceAuthError::AuthFailed);
+    }
+
+    let lxm_from_claims = claims.lxm.as_ref().ok_or_else(|| {
+        VerifyServiceAuthError::Error(anyhow::anyhow!("No lxm claim in service auth JWT"))
+    })?;
+
+    if lxm_from_claims != lxm {
+        return Err(VerifyServiceAuthError::Error(anyhow::anyhow!(
+            "Invalid XRPC endpoint requested"
+        )));
+    }
+    Ok(())
+}
+
+/// Ripped from Jacquard
+///
+/// Extract the signing key from a DID document's verification methods.
+///
+/// This looks for a key with type "atproto" or the first available key
+/// if no atproto-specific key is found.
+fn extract_signing_key(methods: &[VerificationMethod]) -> Option<PublicKey> {
+    // First try to find an atproto-specific key
+    let atproto_method = methods
+        .iter()
+        .find(|m| m.r#type.as_ref() == "Multikey" || m.r#type.as_ref() == "atproto");
+
+    let method = atproto_method.or_else(|| methods.first())?;
+
+    // Parse the multikey
+    let public_key_multibase = method.public_key_multibase.as_ref()?;
+
+    // Decode multibase
+    let (_, key_bytes) = multibase::decode(public_key_multibase.as_ref()).ok()?;
+
+    // First two bytes are the multicodec prefix
+    if key_bytes.len() < 2 {
+        return None;
+    }
+
+    let codec = &key_bytes[..2];
+    let key_material = &key_bytes[2..];
+
+    match codec {
+        // p256-pub (0x1200)
+        [0x80, 0x24] => PublicKey::from_p256_bytes(key_material).ok(),
+        // secp256k1-pub (0xe7)
+        [0xe7, 0x01] => PublicKey::from_k256_bytes(key_material).ok(),
+        _ => None,
+    }
+}
+
+/// Payload for gate JWE tokens
+#[derive(serde::Serialize, serde::Deserialize, Debug)]
+pub struct GateTokenPayload {
+    pub handle: String,
+    pub created_at: String,
+}
+
+/// Generate a secure JWE token for gate verification
+pub fn generate_gate_token(handle: &str, encryption_key: &[u8]) -> Result<String, anyhow::Error> {
+    use josekit::jwe::{JweHeader, alg::direct::DirectJweAlgorithm};
+
+    let payload = GateTokenPayload {
+        handle: handle.to_string(),
+        created_at: Utc::now().to_rfc3339(),
+    };
+
+    let payload_json = serde_json::to_string(&payload)?;
+
+    let mut header = JweHeader::new();
+    header.set_token_type("JWT");
+    header.set_content_encryption("A128CBC-HS256");
+
+    let encrypter = DirectJweAlgorithm::Dir.encrypter_from_bytes(encryption_key)?;
+
+    // Encrypt
+    let jwe = josekit::jwe::serialize_compact(payload_json.as_bytes(), &header, &encrypter)?;
+
+    Ok(jwe)
+}
+
+/// Verify and decrypt a gate JWE token, returning the payload if valid
+pub fn verify_gate_token(
+    token: &str,
+    encryption_key: &[u8],
+) -> Result<GateTokenPayload, anyhow::Error> {
+    let decrypter = DirectJweAlgorithm::Dir.decrypter_from_bytes(encryption_key)?;
+    let (payload_bytes, _header) = josekit::jwe::deserialize_compact(token, &decrypter)?;
+    let payload: GateTokenPayload = serde_json::from_slice(&payload_bytes)?;
+
+    Ok(payload)
+}

src/main.rs

···
 #![warn(clippy::unwrap_used)]
+use crate::gate::{get_gate, post_gate};
 use crate::oauth_provider::sign_in;
-use crate::xrpc::com_atproto_server::{create_account, create_session, get_session, update_email};
-use axum::body::Body;
-use axum::handler::Handler;
-use axum::http::{Method, header};
-use axum::middleware as ax_middleware;
-use axum::routing::post;
-use axum::{Router, routing::get};
+use crate::xrpc::com_atproto_server::{
+    create_account, create_session, describe_server, get_session, update_email,
+};
+use axum::{
+    Router,
+    body::Body,
+    handler::Handler,
+    http::{Method, header},
+    middleware as ax_middleware,
+    routing::get,
+    routing::post,
+};
 use axum_template::engine::Engine;
 use handlebars::Handlebars;
-use hyper_util::client::legacy::connect::HttpConnector;
-use hyper_util::rt::TokioExecutor;
+use hyper_util::{client::legacy::connect::HttpConnector, rt::TokioExecutor};
+use jacquard_common::types::did::Did;
+use jacquard_identity::{PublicResolver, resolver::PlcSource};
 use lettre::{AsyncSmtpTransport, Tokio1Executor};
+use rand::Rng;
 use rust_embed::RustEmbed;
 use sqlx::sqlite::{SqliteConnectOptions, SqliteJournalMode};
 use sqlx::{SqlitePool, sqlite::SqlitePoolOptions};
 use std::path::Path;
+use std::sync::Arc;
 use std::time::Duration;
 use std::{env, net::SocketAddr};
-use tower_governor::GovernorLayer;
-use tower_governor::governor::GovernorConfigBuilder;
-use tower_governor::key_extractor::SmartIpKeyExtractor;
-use tower_http::compression::CompressionLayer;
-use tower_http::cors::{Any, CorsLayer};
+use tower_governor::{
+    GovernorLayer, governor::GovernorConfigBuilder, key_extractor::SmartIpKeyExtractor,
+};
+use tower_http::{
+    compression::CompressionLayer,
+    cors::{Any, CorsLayer},
+};
 use tracing::log;
 use tracing_subscriber::{EnvFilter, fmt, prelude::*};
 
+mod gate;
 pub mod helpers;
 mod middleware;
 mod oauth_provider;
···
 #[include = "*.hbs"]
 struct EmailTemplates;
 
+#[derive(RustEmbed)]
+#[folder = "html_templates"]
+#[include = "*.hbs"]
+struct HtmlTemplates;
+
+/// Mostly the env variables that are used in the app
+#[derive(Clone, Debug)]
+pub struct AppConfig {
+    pds_base_url: String,
+    mailer_from: String,
+    email_subject: String,
+    allow_only_migrations: bool,
+    use_captcha: bool,
+    //The url to redirect to after a successful captcha. Defaults to https://bsky.app, but you may have another social-app fork you rather your users use
+    //that need to capture this redirect url for creating an account
+    default_successful_redirect_url: String,
+    pds_service_did: Did<'static>,
+    gate_jwe_key: Vec<u8>,
+    captcha_success_redirects: Vec<String>,
+}
+
+impl AppConfig {
+    pub fn new() -> Self {
+        let pds_base_url =
+            env::var("PDS_BASE_URL").unwrap_or_else(|_| "http://localhost:3000".to_string());
+        let mailer_from = env::var("PDS_EMAIL_FROM_ADDRESS")
+            .expect("PDS_EMAIL_FROM_ADDRESS is not set in your pds.env file");
+        //Hack not my favorite, but it does work
+        let allow_only_migrations = env::var("GATEKEEPER_ALLOW_ONLY_MIGRATIONS")
+            .map(|val| val.parse::<bool>().unwrap_or(false))
+            .unwrap_or(false);
+
+        let use_captcha = env::var("GATEKEEPER_CREATE_ACCOUNT_CAPTCHA")
+            .map(|val| val.parse::<bool>().unwrap_or(false))
+            .unwrap_or(false);
+
+        // PDS_SERVICE_DID is the did:web if set, if not it's PDS_HOSTNAME
+        let pds_service_did =
+            env::var("PDS_SERVICE_DID").unwrap_or_else(|_| match env::var("PDS_HOSTNAME") {
+                Ok(pds_hostname) => format!("did:web:{}", pds_hostname),
+                Err(_) => {
+                    panic!("PDS_HOSTNAME or PDS_SERVICE_DID must be set in your pds.env file")
+                }
+            });
+
+        let email_subject = env::var("GATEKEEPER_TWO_FACTOR_EMAIL_SUBJECT")
+            .unwrap_or("Sign in to Bluesky".to_string());
+
+        // Load or generate JWE encryption key (32 bytes for AES-256)
+        let gate_jwe_key = env::var("GATEKEEPER_JWE_KEY")
+            .ok()
+            .and_then(|key_hex| hex::decode(key_hex).ok())
+            .unwrap_or_else(|| {
+                // Generate a random 32-byte key if not provided
+                let key: Vec<u8> = (0..32).map(|_| rand::rng().random()).collect();
+                log::warn!("WARNING: No GATEKEEPER_JWE_KEY found in the environment. Generated random key (hex): {}", hex::encode(&key));
+                log::warn!("This is not strictly needed unless you scale PDS Gatekeeper. Will not also be able to verify tokens between reboots, but they are short lived (5mins).");
+                key
+            });
+
+        if gate_jwe_key.len() != 32 {
+            panic!(
+                "GATEKEEPER_JWE_KEY must be 32 bytes (64 hex characters) for AES-256 encryption"
+            );
+        }
+
+        let captcha_success_redirects = match env::var("GATEKEEPER_CAPTCHA_SUCCESS_REDIRECTS") {
+            Ok(from_env) => from_env.split(",").map(|s| s.trim().to_string()).collect(),
+            Err(_) => {
+                vec![
+                    String::from("https://bsky.app"),
+                    String::from("https://pdsmoover.com"),
+                    String::from("https://blacksky.community"),
+                    String::from("https://tektite.cc"),
+                ]
+            }
+        };
+
+        AppConfig {
+            pds_base_url,
+            mailer_from,
+            email_subject,
+            allow_only_migrations,
+            use_captcha,
+            default_successful_redirect_url: env::var("GATEKEEPER_DEFAULT_CAPTCHA_REDIRECT")
+                .unwrap_or("https://bsky.app".to_string()),
+            pds_service_did: pds_service_did
+                .parse()
+                .expect("PDS_SERVICE_DID is not a valid did or could not infer from PDS_HOSTNAME"),
+            gate_jwe_key,
+            captcha_success_redirects,
+        }
+    }
+}
+
 #[derive(Clone)]
 pub struct AppState {
     account_pool: SqlitePool,
     pds_gatekeeper_pool: SqlitePool,
     reverse_proxy_client: HyperUtilClient,
-    pds_base_url: String,
     mailer: AsyncSmtpTransport<Tokio1Executor>,
-    mailer_from: String,
     template_engine: Engine<Handlebars<'static>>,
+    resolver: Arc<PublicResolver>,
+    app_config: AppConfig,
 }
 
 async fn root_handler() -> impl axum::response::IntoResponse {
···
     //Emailer set up
     let smtp_url =
         env::var("PDS_EMAIL_SMTP_URL").expect("PDS_EMAIL_SMTP_URL is not set in your pds.env file");
-    let sent_from = env::var("PDS_EMAIL_FROM_ADDRESS")
-        .expect("PDS_EMAIL_FROM_ADDRESS is not set in your pds.env file");
 
     let mailer: AsyncSmtpTransport<Tokio1Executor> =
         AsyncSmtpTransport::<Tokio1Executor>::from_url(smtp_url.as_str())?.build();
···
         let _ = hbs.register_embed_templates::<EmailTemplates>();
     }
 
-    let pds_base_url =
-        env::var("PDS_BASE_URL").unwrap_or_else(|_| "http://localhost:3000".to_string());
+    let _ = hbs.register_embed_templates::<HtmlTemplates>();
+
+    //Reads the PLC source from the pds env's or defaults to ol faithful
+    let plc_source_url =
+        env::var("PDS_DID_PLC_URL").unwrap_or_else(|_| "https://plc.directory".to_string());
+    let plc_source = PlcSource::PlcDirectory {
+        base: plc_source_url.parse().unwrap(),
+    };
+    let mut resolver = PublicResolver::default();
+    resolver = resolver.with_plc_source(plc_source.clone());
 
     let state = AppState {
         account_pool,
         pds_gatekeeper_pool,
         reverse_proxy_client: client,
-        pds_base_url,
         mailer,
-        mailer_from: sent_from,
         template_engine: Engine::from(hbs),
+        resolver: Arc::new(resolver),
+        app_config: AppConfig::new(),
     };
 
     // Rate limiting
     //Allows 5 within 60 seconds, and after 60 should drop one off? So hit 5, then goes to 4 after 60 seconds.
-    let create_session_governor_conf = GovernorConfigBuilder::default()
+    let captcha_governor_conf = GovernorConfigBuilder::default()
         .per_second(60)
         .burst_size(5)
         .key_extractor(SmartIpKeyExtractor)
···
         "failed to create governor config for create account. this should not happen and is a bug",
     );
 
-    let create_session_governor_limiter = create_session_governor_conf.limiter().clone();
+    let captcha_governor_limiter = captcha_governor_conf.limiter().clone();
     let sign_in_governor_limiter = sign_in_governor_conf.limiter().clone();
     let create_account_governor_limiter = create_account_governor_conf.limiter().clone();
+
+    let sign_in_governor_layer = GovernorLayer::new(sign_in_governor_conf);
 
     let interval = Duration::from_secs(60);
     // a separate background task to clean up
     std::thread::spawn(move || {
         loop {
             std::thread::sleep(interval);
-            create_session_governor_limiter.retain_recent();
+            captcha_governor_limiter.retain_recent();
             sign_in_governor_limiter.retain_recent();
             create_account_governor_limiter.retain_recent();
         }
···
         .allow_methods([Method::GET, Method::OPTIONS, Method::POST])
         .allow_headers(Any);
 
-    let app = Router::new()
+    let mut app = Router::new()
         .route("/", get(root_handler))
         .route("/xrpc/com.atproto.server.getSession", get(get_session))
         .route(
+            "/xrpc/com.atproto.server.describeServer",
+            get(describe_server),
+        )
+        .route(
             "/xrpc/com.atproto.server.updateEmail",
             post(update_email).layer(ax_middleware::from_fn(middleware::extract_did)),
         )
         .route(
             "/@atproto/oauth-provider/~api/sign-in",
-            post(sign_in).layer(GovernorLayer::new(sign_in_governor_conf)),
+            post(sign_in).layer(sign_in_governor_layer.clone()),
         )
         .route(
             "/xrpc/com.atproto.server.createSession",
-            post(create_session.layer(GovernorLayer::new(create_session_governor_conf))),
+            post(create_session.layer(sign_in_governor_layer)),
         )
         .route(
             "/xrpc/com.atproto.server.createAccount",
             post(create_account).layer(GovernorLayer::new(create_account_governor_conf)),
-        )
+        );
+
+    if state.app_config.use_captcha {
+        app = app.route(
+            "/gate/signup",
+            get(get_gate).post(post_gate.layer(GovernorLayer::new(captcha_governor_conf))),
+        );
+    }
+
+    let app = app
         .layer(CompressionLayer::new())
         .layer(cors)
         .with_state(state);

src/oauth_provider.rs

···
                 //No 2FA or already passed
                 let uri = format!(
                     "{}{}",
-                    state.pds_base_url, "/@atproto/oauth-provider/~api/sign-in"
+                    state.app_config.pds_base_url, "/@atproto/oauth-provider/~api/sign-in"
                 );
 
                 let mut req = axum::http::Request::post(uri);

src/xrpc/com_atproto_server.rs

···
 use crate::AppState;
 use crate::helpers::{
-    AuthResult, ProxiedResult, TokenCheckError, json_error_response, preauth_check, proxy_get_json,
+    AuthResult, ProxiedResult, TokenCheckError, VerifyServiceAuthError, json_error_response,
+    preauth_check, proxy_get_json, verify_gate_token, verify_service_auth,
 };
 use crate::middleware::Did;
-use axum::body::Body;
+use axum::body::{Body, to_bytes};
 use axum::extract::State;
-use axum::http::{HeaderMap, StatusCode};
+use axum::http::{HeaderMap, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum::{Extension, Json, debug_handler, extract, extract::Request};
+use chrono::{Duration, Utc};
+use jacquard_common::types::did::Did as JacquardDid;
 use serde::{Deserialize, Serialize};
 use serde_json;
 use tracing::log;
···
     allow_takendown: Option<bool>,
 }
 
+#[derive(Deserialize, Serialize, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct CreateAccountRequest {
+    handle: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    email: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    password: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    did: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    invite_code: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    verification_code: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    plc_op: Option<serde_json::Value>,
+}
+
+#[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct DescribeServerContact {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    email: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct DescribeServerLinks {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    privacy_policy: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    terms_of_service: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct DescribeServerResponse {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    invite_code_required: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    phone_verification_required: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    available_user_domains: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    links: Option<DescribeServerLinks>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    contact: Option<DescribeServerContact>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    did: Option<String>,
+}
+
 pub async fn create_session(
     State(state): State<AppState>,
     headers: HeaderMap,
···
                 //No 2FA or already passed
                 let uri = format!(
                     "{}{}",
-                    state.pds_base_url, "/xrpc/com.atproto.server.createSession"
+                    state.app_config.pds_base_url, "/xrpc/com.atproto.server.createSession"
                 );
 
                 let mut req = axum::http::Request::post(uri);
···
     // Updating the actual email address by sending it on to the PDS
     let uri = format!(
         "{}{}",
-        state.pds_base_url, "/xrpc/com.atproto.server.updateEmail"
+        state.app_config.pds_base_url, "/xrpc/com.atproto.server.updateEmail"
     );
     let mut req = axum::http::Request::post(uri);
     if let Some(req_headers) = req.headers_mut() {
···
     }
 }
 
+pub async fn describe_server(
+    State(state): State<AppState>,
+    req: Request,
+) -> Result<Response<Body>, StatusCode> {
+    match proxy_get_json::<DescribeServerResponse>(
+        &state,
+        req,
+        "/xrpc/com.atproto.server.describeServer",
+    )
+    .await?
+    {
+        ProxiedResult::Parsed {
+            value: mut server_info,
+            ..
+        } => {
+            //This signifies the server is configured for captcha verification
+            server_info.phone_verification_required = Some(state.app_config.use_captcha);
+            Ok(Json(server_info).into_response())
+        }
+        ProxiedResult::Passthrough(resp) => Ok(resp),
+    }
+}
+
+/// Verify a gate code matches the handle and is not expired
+async fn verify_gate_code(
+    state: &AppState,
+    code: &str,
+    handle: &str,
+) -> Result<bool, anyhow::Error> {
+    // First, decrypt and verify the JWE token
+    let payload = match verify_gate_token(code, &state.app_config.gate_jwe_key) {
+        Ok(p) => p,
+        Err(e) => {
+            log::warn!("Failed to decrypt gate token: {}", e);
+            return Ok(false);
+        }
+    };
+
+    // Verify the handle matches
+    if payload.handle != handle {
+        log::warn!(
+            "Gate code handle mismatch: expected {}, got {}",
+            handle,
+            payload.handle
+        );
+        return Ok(false);
+    }
+
+    let created_at = chrono::DateTime::parse_from_rfc3339(&payload.created_at)
+        .map_err(|e| anyhow::anyhow!("Failed to parse created_at from token: {}", e))?
+        .with_timezone(&Utc);
+
+    let now = Utc::now();
+    let age = now - created_at;
+
+    // Check if the token is expired (5 minutes)
+    if age > Duration::minutes(5) {
+        log::warn!("Gate code expired for handle {}", handle);
+        return Ok(false);
+    }
+
+    // Verify the token exists in the database (to prevent reuse)
+    let row: Option<(String,)> =
+        sqlx::query_as("SELECT code FROM gate_codes WHERE code = ? and handle = ? LIMIT 1")
+            .bind(code)
+            .bind(handle)
+            .fetch_optional(&state.pds_gatekeeper_pool)
+            .await?;
+
+    if row.is_none() {
+        log::warn!("Gate code not found in database or already used");
+        return Ok(false);
+    }
+
+    // Token is valid, delete it so it can't be reused
+    //TODO probably also delete expired codes? Will need to do that at some point probably altho the where is on code and handle
+
+    sqlx::query("DELETE FROM gate_codes WHERE code = ?")
+        .bind(code)
+        .execute(&state.pds_gatekeeper_pool)
+        .await?;
+
+    Ok(true)
+}
+
 pub async fn create_account(
     State(state): State<AppState>,
-    mut req: Request,
+    req: Request,
 ) -> Result<Response<Body>, StatusCode> {
-    //TODO if I add the block of only accounts authenticated just take the body as json here and grab the lxm token. No middle ware is needed
+    let headers = req.headers().clone();
+    let body_bytes = to_bytes(req.into_body(), usize::MAX)
+        .await
+        .map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    // Parse the body to check for verification code
+    let account_request: CreateAccountRequest =
+        serde_json::from_slice(&body_bytes).map_err(|e| {
+            log::error!("Failed to parse create account request: {}", e);
+            StatusCode::BAD_REQUEST
+        })?;
+
+    // Check for service auth (migrations) if configured
+    if state.app_config.allow_only_migrations {
+        // Expect Authorization: Bearer <jwt>
+        let auth_header = headers
+            .get(header::AUTHORIZATION)
+            .and_then(|v| v.to_str().ok())
+            .map(str::to_string);
+
+        let Some(value) = auth_header else {
+            log::error!("No Authorization header found in the request");
+            return json_error_response(
+                StatusCode::UNAUTHORIZED,
+                "InvalidAuth",
+                "This PDS is configured to only allow accounts created by migrations via this endpoint.",
+            );
+        };
+
+        // Ensure Bearer prefix
+        let token = value.strip_prefix("Bearer ").unwrap_or("").trim();
+        if token.is_empty() {
+            log::error!("No Service Auth token found in the Authorization header");
+            return json_error_response(
+                StatusCode::UNAUTHORIZED,
+                "InvalidAuth",
+                "This PDS is configured to only allow accounts created by migrations via this endpoint.",
+            );
+        }
+
+        // Ensure a non-empty DID was provided when migrations are enabled
+        let requested_did_str = match account_request.did.as_deref() {
+            Some(s) if !s.trim().is_empty() => s,
+            _ => {
+                return json_error_response(
+                    StatusCode::BAD_REQUEST,
+                    "InvalidRequest",
+                    "The 'did' field is required when migrations are enforced.",
+                );
+            }
+        };
+
+        // Parse the DID into the expected type for verification
+        let requested_did: JacquardDid<'static> = match requested_did_str.parse() {
+            Ok(d) => d,
+            Err(e) => {
+                log::error!(
+                    "Invalid DID format provided in createAccount: {} | error: {}",
+                    requested_did_str,
+                    e
+                );
+                return json_error_response(
+                    StatusCode::BAD_REQUEST,
+                    "InvalidRequest",
+                    "The 'did' field is not a valid DID.",
+                );
+            }
+        };
 
+        let nsid = "com.atproto.server.createAccount".parse().unwrap();
+        match verify_service_auth(
+            token,
+            &nsid,
+            state.resolver.clone(),
+            &state.app_config.pds_service_did,
+            &requested_did,
+        )
+        .await
+        {
+            //Just do nothing if it passes so it continues.
+            Ok(_) => {}
+            Err(err) => match err {
+                VerifyServiceAuthError::AuthFailed => {
+                    return json_error_response(
+                        StatusCode::UNAUTHORIZED,
+                        "InvalidAuth",
+                        "This PDS is configured to only allow accounts created by migrations via this endpoint.",
+                    );
+                }
+                VerifyServiceAuthError::Error(err) => {
+                    log::error!("Error verifying service auth token: {err}");
+                    return json_error_response(
+                        StatusCode::BAD_REQUEST,
+                        "InvalidRequest",
+                        "There has been an error, please contact your PDS administrator for help and for them to review the server logs.",
+                    );
+                }
+            },
+        }
+    }
+
+    // Check for captcha verification if configured
+    if state.app_config.use_captcha {
+        if let Some(ref verification_code) = account_request.verification_code {
+            match verify_gate_code(&state, verification_code, &account_request.handle).await {
+                //TODO has a few errors to support
+
+                //expired token
+                //     {
+                //     "error": "ExpiredToken",
+                //     "message": "Token has expired"
+                // }
+
+                //TODO ALSO add rate limits on the /gate endpoints so they can't be abused
+                Ok(true) => {
+                    log::info!("Gate code verified for handle: {}", account_request.handle);
+                }
+                Ok(false) => {
+                    log::warn!(
+                        "Invalid or expired gate code for handle: {}",
+                        account_request.handle
+                    );
+                    return json_error_response(
+                        StatusCode::BAD_REQUEST,
+                        "InvalidToken",
+                        "Token could not be verified",
+                    );
+                }
+                Err(e) => {
+                    log::error!("Error verifying gate code: {}", e);
+                    return json_error_response(
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        "InvalidToken",
+                        "Token could not be verified",
+                    );
+                }
+            }
+        } else {
+            // No verification code provided but captcha is required
+            log::warn!(
+                "No verification code provided for account creation: {}",
+                account_request.handle
+            );
+            return json_error_response(
+                StatusCode::BAD_REQUEST,
+                "InvalidRequest",
+                "Verification is now required on this server.",
+            );
+        }
+    }
+
+    // Rebuild the request with the same body and headers
     let uri = format!(
         "{}{}",
-        state.pds_base_url, "/xrpc/com.atproto.server.createAccount"
+        state.app_config.pds_base_url, "/xrpc/com.atproto.server.createAccount"
     );
 
-    // Rewrite the URI to point at the upstream PDS; keep headers, method, and body intact
-    *req.uri_mut() = uri.parse().map_err(|_| StatusCode::BAD_REQUEST)?;
+    let mut new_req = axum::http::Request::post(&uri);
+    if let Some(req_headers) = new_req.headers_mut() {
+        *req_headers = headers;
+    }
+
+    let new_req = new_req
+        .body(Body::from(body_bytes))
+        .map_err(|_| StatusCode::BAD_REQUEST)?;
 
     let proxied = state
         .reverse_proxy_client
-        .request(req)
+        .request(new_req)
         .await
         .map_err(|_| StatusCode::BAD_REQUEST)?
         .into_response();