The problem with bots
Imposing a cost on every sign-up that is free to the honest user.
One person or one script can open thousands of accounts for almost nothing. That produces spam, fake reviews, vote stuffing, and farmed free tiers.
Service providers pay to stop it. Legitimate users pay in friction.
The usual defences—phone numbers, ID checks, captchas, or sign-in with a large platform—raise the cost of a fake account, but they also raise the cost and the friction of a real one.
Those same defences are becoming cheaper for an attacker to clear, especially once the attacker is an AI agent rather than a simple script. Open services feel this more sharply than closed ones, because they have fewer places to put friction without driving real users away.
Where the cost can sit
Bitcoin showed that a cost can be imposed on the thing being created rather than on the person creating it.
The same idea can be applied to an identifier. Instead of an identifier that is free to mint and then filtered, the identifier itself can carry a cost that was paid when it was made.
A legitimate user who already owns a device pays that cost once. A bulk producer must pay it for every identifier, and the cost does not amortise.
Running a door costs the service, and passing through it costs visitors in friction. A bulk operator can sometimes solve or bypass the door once and reuse the result across many accounts.
The scarce step sits in making each object: the design aims for a fresh production cost each time. Checking remains a separate cost.
How to impose a cost
The cost sits on a new kind of identifier. A PCOC is a self-issued identifier that carries a public key and a measurable resource commitment bound to Bitcoin time.
Your own device creates the key, holds 256 MiB of memory while Bitcoin blocks pass, and records the work. The finished object is small.
Anyone can later measure that the resource was held. Bitcoin is the clock and the anchor; it does not certify the work. Checking is cheap. Making is not free at scale.
PCOC stands for production-constrained observable commitment: a cryptographic commitment of a resource, bound to Bitcoin time, for an identifier.
PCOC in a nutshell
Follow one
Making that commitment is the work. Your device creates a key and holds the memory in stages paced by Bitcoin blocks. Points along the way are anchored to Bitcoin.
When the last stage closes, the memory is released and you keep a small file: your identifier, your public key, and the record of its making.
A service that receives it can measure the recorded work and then apply its own policy. One service may treat the measurement as enough and admit the account. Another may want a higher bar and ask for more.
The measurement is the same; the decision is not.
How PCOC is used
Someone produces a PCOC on their own device. A service measures that PCOC and applies its policy. The apps do the producing today. A service measures in one of three ways:
- Sign in on this site uses the hosted gate.
- Run the admission gate on a machine you operate.
- Embed the verifier and apply your own policy.
Explore PCOC
One story, many doors. Each ends in the same place: a cost on each new identifier, checked by anyone, judged by each service.
The pages that follow take that cost through one making, the apps, a service integration, why bots win when accounts are free, and the specification.
Open systems & identity
Open systems
Open protocols and open servers let anyone join, and bots join too, so a service that needs protection falls back on a big-platform sign-in.
A PCOC lets people join with an identifier they made themselves, and each new identifier carries its own cost.
Self-sovereign identity
Bots can self-issue too, and the usual fix, an issuer, brings back the third party.
A PCOC is self-issued and carries a record of its making that anyone can check without the maker's key.
Nostr
A Nostr key is free to make, so bots get one too, and relays fall back on paid admission or close sign-up.
A PCOC gives a new key a cost to make, and a record of it that anyone can check, so a relay or app can let people in with their own key, and a demonstrator on the previous version runs today.
Threats
Trust and safety
If you run open sign-up, bots land on you: detection they beat once and reuse, or a phone or ID check that also shuts out real people.
An admission gate keeps sign-up open, each new sign-up brings a PCOC with a cost of its own, and your policy decides.
AI and high-cost services
Free tiers get farmed: one script, many sign-ups, real compute gone.
Put an admission gate in front of the free tier, so each new sign-up brings a PCOC with a cost of its own, with no phone number or ID.
Cost & economics
Cost asymmetry
Today a bot farm beats a filter once and reuses the answer, while the service checks every sign-up, forever.
A PCOC is designed to flip it: the cost goes into the making, and the check costs far less than the making.
Economics
One person spends time on a machine they already have. Making many takes hardware, and that cost is still being measured.
Tech
Bitcoin
An open network needs a way to make each new identifier cost something without a gatekeeper.
Bitcoin is the clock and the anchor, so a PCOC is made while blocks pass, and you need no bitcoin, wallet or node.
What this does not claim
A PCOC does not identify a person, and it does not make fake accounts impossible. It gives a service something it can ask for at sign-up. It does not, by itself, decide who gets in.
- It is not a name, a passport, or a platform account. It says nothing about who made it.
- It is not an admission. Whether to accept one identifier per account, and what counts as enough, is the service's decision.
- It is not a certificate from Bitcoin. Bitcoin is the clock and the anchor. It does not certify the work.
- The design aims to give bulk making no discount. Whether making many at once can substantially cut the cost of one of them is still being measured.