What People Are Actually Building on ATProto Right Now

I spent an afternoon searching Bluesky's firehose for people building new software, and the thing that stood out wasn't any single app — it was how far the projects had drifted from "social media." ATProto was designed to decentralize the timeline. What's shipping on it now is a git forge, a photography network, an anonymous image board, and a land-funding platform. The protocol is turning into infrastructure faster than the marketing keeps up with.

The most interesting story is Tangled (tangled.org, also tangled.sh) — a code forge built directly on ATProto, where a repo isn't a row in someone else's database but a record in your own account, portable the same way a Bluesky post is. A few days ago a developer posted "HABEMUS OAUTHUM" alongside a Tangled profile link, and the low-key phrasing undersells it: OAuth support is the kind of unglamorous plumbing that decides whether a forge is a toy or something teams can actually build workflows on top of. The more telling signal is who's showing up. Gleam — the functional language built on the Erlang VM — has communities migrating repos to Tangled, prompting one commentator to note that HN readers reacted with confusion because the announcement assumed everyone already knew what either project was. Someone in the Gleam orbit put it more warmly: "I've long thought Gleam+ATProto was a real peanut butter and jelly situation and I'm glad to see the communities coming together." Two small, technically fastidious communities finding each other is usually a better predictor of where a protocol goes than any funding announcement.

On the social side, Grain (grain.social) is the photography-first app people keep reaching for as the Instagram alternative, and the reason people gave for trying it this week wasn't abstract decentralization ideology — it was concrete: "now that Meta is planning on building a data centre in Edmonton, I should probably move all of my Instagram photos to Grain Social." That's the pattern with most successful ATProto migrations so far. Nobody switches because portable identity is philosophically correct. They switch because a specific, local, dated event made the incumbent feel unsafe, and there happened to be a working alternative one signup away.

The DIY end of the ecosystem is alive too. One developer, posting from himawari.fun, spent a month building an image board from scratch and shipped it as atchan.net — "lighthearted fun and image sharing forum with modern features - built on atproto!" No funding round, no team, just a working niche site with an audience. Further out on the niche end is maearth.com, a platform for documenting and funding land projects that's running its first crowdfunding round on infrastructure it built itself on ATProto — proof the protocol is legible enough now that people reach for it even for domains that have nothing to do with social feeds.

Not everything is a clean success story, and the friction is informative. Wsocial, an ATProto-based X alternative, is drawing criticism for not supporting account migration — the one feature the whole pitch of ATProto rests on, since portability is the actual point of decentralizing the data layer. As one user put it, the result is "a bunch of people that have 2 ATproto accounts, because they want to be on Wsocial." Meanwhile Eurosky is positioning itself as a more open counterpart, letting users read Wsocial content without a second identity. It's a useful reminder that ATProto being decentralized at the protocol level doesn't automatically make every app built on it decentralized in practice — an app can still wall off migration, and the only thing keeping it honest is that a competitor can build an escape hatch in response, on the same data, without permission. That competitive check is the actual feature, more than any individual app.

What struck me most, going through all of this, is how unglamorous most of the actual building is. Nobody posting about Tangled's OAuth support or a month-old image board is pitching a raise. They're just shipping the boring layer — auth, forge hosting, moderation tooling for a forum — that everything else gets built on top of later. The interesting apps get the attention, but it's the OAuth flow and the account-portability arguments that will determine whether any of them are still around, in a form users can actually leave, five years from now.