How ActivityPub Federates Social Interactions

The ActivityPub protocol enables web development platforms to decentralize social networking by establishing a common standard for distributing content and interactions across independent servers. By providing a uniform format for data and communication, ActivityPub allows disparate applications—ranging from blogs and content management systems to microblogging and video-sharing networks—to interact as a unified network known as the fediverse. Users on one platform can seamlessly follow, comment on, like, and share content produced on an entirely separate platform without requiring an account on both.

The Foundation: Actors, Objects, and Activities

ActivityPub relies on the ActivityStreams 2.0 data format, a JSON-LD specification that standardizes social interactions. At the core of this system are three primary concepts:

  • Actors: The entities performing actions, such as users, groups, bots, or applications. Each actor is identified by a unique URI.
  • Objects: The content being acted upon, including articles, notes, images, videos, or comments.
  • Activities: The actions taken by actors on objects, represented by standard verbs such as Create, Update, Delete, Follow, Like, and Announce (share/boost).

By structuring data into these semantic primitives, web applications can interpret incoming content regardless of the software running on the sender's server.

Delivery via Inboxes and Outboxes

Federation occurs through two core HTTP-based endpoints that every ActivityPub actor maintains: an Inbox and an Outbox.

  1. The Outbox (Client-to-Server and Originating Federation): When a user creates content on a local platform, the client sends an activity to the user's outbox. The local server processes the activity, saves it locally, and determines which remote servers need to receive it based on the user's followers or explicitly targeted recipients.
  2. The Inbox (Server-to-Server Federation): The originating server delivers the activity across the internet via an HTTP POST request to the inboxes of all recipient actors or servers. When a remote server receives an activity in an inbox, it parses the JSON-LD payload, validates it, and incorporates the interaction into its own local database and user interface.

Identity and Discovery with WebFinger

To facilitate cross-platform connections, ActivityPub relies on the WebFinger protocol. WebFinger maps human-readable identifiers—formatted similarly to email addresses, such as @username@example.com—to the actor's canonical HTTPS profile URI. This allows users across the fediverse to search for and follow creators hosted on completely different domains without needing to know the exact technical endpoints of the remote server.

Authentication and Trust via HTTP Signatures

Because federated servers operate independently, security and authenticity are critical. ActivityPub platforms use asymmetric cryptography to secure interactions:

  • Each actor possesses a public and private key pair.
  • The actor’s public key is published within their publicly accessible ActivityStreams profile.
  • When a server federates an activity to a remote inbox, it signs the HTTP request using its private key (HTTP Signatures).
  • The receiving server fetches the sender’s public key to verify the cryptographic signature, ensuring that the payload was not tampered with in transit and genuinely originated from the claimed actor.

Platform Interoperability

By implementing ActivityPub, web developers can transform standalone websites into active participants in the fediverse. A developer can build a custom content management system where publishing a blog post automatically dispatches a Create activity to subscribers on platforms like Mastodon. When a Mastodon user replies to that post, a Create activity containing a Note object is posted back to the blog's inbox, allowing the comment to render natively under the original article. This architecture decouples social data from single-vendor silos, creating a resilient, interconnected web ecosystem.