Approval Token

This token represents an approval of another user’s content. When you approve someone’s action (e.g., a POST), it signals trust and enables federated fan-out to your followers.

The approval token must NOT contain a content (c) or attachments (a) field. The token must contain a subject (sub) field referencing the action being approved. For other constraints see the Action Tokens. Like every action token it is content-addressed — see Content Addressing.

Purpose

An APRV endorses someone else’s action: it broadcasts the approved content to your followers and sets the original action’s status to Active (A) on the author’s instance, which is how content spreads across trusted connections.

Required Fields

Field Required Description
iss Yes Your identity (the approver)
aud Yes The issuer of the approved action (content creator)
sub Yes The action_id being approved (a1~...)
t Yes “APRV”
c Forbidden Content field is not allowed
a Forbidden Attachments field is not allowed

Subject Reference

The sub (subject) field references the action being approved:

  • Contains the target action’s action_id (a1~...)
  • Target action must exist and be verifiable
  • Creates a non-hierarchical reference

APRV uses sub rather than p so an approval does not thread under the approved action — see Parent vs Subject.

Broadcast Behavior

APRV tokens have broadcast=true behavior, meaning:

  • When you create an APRV, it’s sent to all your followers
  • The approved action (e.g., the POST) is bundled with the APRV delivery
  • Recipients receive both the APRV and the related action in a single delivery

This is how content spreads across the federated network through trust relationships.

Federation Flow

Creating an approval: The approver creates an APRV (aud = content creator, sub = content action_id). Because APRV is a broadcast action, delivery fans out to all of the approver’s followers, bundling the approved action so recipients receive both in a single delivery.

Receiving an approval: When an APRV for your content arrives, the server verifies the JWT signature and permissions, then the on_receive hook finds the subject action and updates its status to A (Active/Approved).

Auto-Approval

The system can automatically create APRV tokens for content from trusted connections. See Auto-Approval for details.

Auto-approval conditions:

  1. Action type must be approvable (POST, MSG, REPOST)
  2. Action is addressed to you (audience = your id_tag)
  3. Sender is different from you
  4. profile.auto_approve_actions setting is enabled
  5. Sender is connected (bidirectional connection established)

When an APRV is delivered, the approved action is included:

{
  "token": "eyJhbGciOi...APRV_TOKEN",
  "related": ["eyJhbGciOi...APPROVED_POST_TOKEN"]
}

Recipients receive both tokens in a single request. The related action is processed after the APRV, with permission checks skipped (pre-approved by the APRV issuer’s trust).

Example

User @alice.cloudillo.net approves a post from @bob.cloudillo.net:

Field Value
iss alice.cloudillo.net
aud bob.cloudillo.net
iat 2024-04-13T00:01:10.000Z
k 20240301
t APRV
sub a1~NAado5PS4j5+abYtRpBELU0e5OQ+zGf/tuuWvUwQ6PA=

Flow:

  1. Alice approves Bob’s post
  2. APRV is sent to Bob (notification)
  3. APRV + Bob’s POST are broadcast to Alice’s followers
  4. Bob’s post status is updated to ‘A’ (Active/Approved)

See Also