Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
Building AIP: An ATProtocol Authorization Gateway - Nick's Blog
OAuth is the first challenge developers face in the atmosphere. This post is about AIP, the authorization gateway we built at Graze Social to alleviate some of the pain.
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
ATProto User Intents Demo
This is a demo tool which allows atproto accounts to configure a reuse declaration for their public data. You can read more about this atproo mechanism in the "User Intents for Data Reuse" proposal from March 2025. Any account in the atproto network (including Bluesky accounts) can use this tool via OAuth. The source code for this demo is linked above.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
Your identity isn't your username
Your handle is a label; your identity is a key you own. atproto splits who you are from what you're called, so you can rename freely, prove who you are with a domain you control, and carry one identity across the apps you use. Part of 'Apps as Views, Not Vaults': the things you make are yours; apps are just the viewers.
this is kinda another reason im starting to think more and more that there would be worth in splitting atprotos identity layer out as its own spec and standard. building up handles and oauth around a DID makes for a really flexible cross platform (and potentially cross ecosystem) identity system
Nelind
i kinda hate how atproto adopting DIDs has made people intrinsically associate DIDs with atproto ... it makes some people see me as some annoying bitch trying to shove atproto into places it obviously doesnt belong in when i suggest using DIDs as user identifiers for other systems
Another OIDC gateway approach for using your atproto account to login to many different things tangled.org/bkb.arcnode.xyz/atauth Nice work @bkb.arcnode.xyz!
bkb
Giving @tangled.org a try. Updates to the atauth OIDC gateway are live. Passkey login for all apps -- Sign in with biometrics or a security key on every app 8 security fixes enforced session expiry Multi-arch Docker on GHCR One docker pull for amd64 and arm64 (Pi, Apple Silicon)
Hey @surf.social the atproto early adopter / tech community can’t recommend you until you implement OAuth. This is a pretty big user security issue. Let us know if you need help or contract @thisismissem.social
im'bcmgs'im
surf.social looks amazing but idk about this login experience... i dont normally wanna put my password for one site into another site 🙃
here's my take on a minimal oauth browser client for atproto! no special API client class — just use plain `fetch` to make requests and a service worker automatically handles authorization headers/token refreshes/dpop retries/etc. (very experimental, not tested in production, use at your own risk)
jakelazaroff.com/atsw
tangled.org
