1
POST to send
Sending someone a message is an HTTP POST to their URL — say https://alice.example — carrying a signed JSON envelope in the body.
a messaging protocol
Send someone a message,
let them prove it came from you.
No accounts. No shared API keys. No service in the middle. Each participant is a URL — HTTPS bootstraps the trust, an Ed25519 signature does the rest.
Why a protocol, not a product
The wire protocol is the contract. The Go binary is one implementation; build another in any language with an HTTP client and Ed25519, in well under 100 lines.
The repo ships normative test vectors — they keep every implementation honest.
How it works
Three things every URL agrees to do.
2
GET to identify
The same URL, on GET, returns an actor doc with the participant's published public keys. The URL is the identity; everything else is a label.
3
Sign the body
An Ed25519 signature over the raw POST body. No header canonicalization, no string-to-sign rules — read bytes, verify, parse.
Quick start
A single Go binary. SQLite for storage. No cgo.
The reference implementation ships as posta — a CLI with a daemon mode (posta serve), an interactive inbox TUI (posta), and one-shot send for shell pipelines.
# install
go install code.bas.es/posta/spec/cmd/posta@latest
# first-run setup (URL, TLS mode, display name)
posta init
# start the daemon — auto-TLS via Let's Encrypt by default
posta serve
# open the inbox/compose TUI
posta
# one-shot send, for shell pipelines
echo '{"hello":"world"}' | posta send https://bob.example