XRPC requests between atproto servers are authenticated using JWTs. There are some inconsistencies in how OAuth permissions, PDS proxy headers, and JWTs all represent the "audience" of these tokens. This proposal gives background and describes a rough solution. Looking for rapid feedback!
proposals/0013-service-auth-refs at main · bluesky-social/proposals
github.comMar 3, 2026 at 11:01 PM
Authenticated XRPC Calls in Lexicon Garden - Nick's Blog
ATProtocol OAuth pairs effortlessly with Lexicon Garden to make it easy for developers to experiment with authenticated XRPC endpoints.
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
Building a Browser-Based ATProtocol OAuth App with Supporter Validation - ATProtoFans Blog
Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
sparrowtek.com/atproto-auth-proxy
Stateless auth proxy that converts AT Protocol native apps from public to confidential OAuth clients. Deploy once, get 180-day refresh tokens instead of 24-hour ones.
sparrowtek.com/atproto-auth-proxy
Stateless auth proxy that converts AT Protocol native apps from public to confidential OAuth clients. Deploy once, get 180-day refresh tokens instead of 24-hour ones.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
tijs/atproto-oauth
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications
here's my take on a minimal oauth browser client for atproto! no special API client class — just use plain `fetch` to make requests and a service worker automatically handles authorization headers/token refreshes/dpop retries/etc. (very experimental, not tested in production, use at your own risk)
jakelazaroff.com/atsw
tangled.orgI think I found an issue with the existing Bluesky OAuth permission sets @matthieu.bsky.team @bnewbold.net: github.com/bluesky-social/atproto/issues…. The XRPC endpoints specified in `authViewAll` are inconsistent about aud. Minimal repro here. tangled.org/tylerjfisher.com/repro-bluesk… Might be doing something wrong, lmk!
Bluesky permission sets require inconsistent aud parameter · Issue #4850 · bluesky-social/atproto
github.comatpxrpc is a tool in the atproto-crates that makes it easy to invoke XRPC methods. It supports multiple identities, direct and proxy XRPC calls, binary inputs, and more. Install with homebrew: brew tap ngerakines/tap && brew install atpxrpc Read more at ngerakines.me/atpxrpc.html
atpxrpc
ngerakines.mealright protocol devs, some wonky bits: we revisited the recent service auth JWT harmonization proposal, and have a revision up that sticks with a single string 'aud' field. also touches on issuer 'kid', and makes 'lxm' mandatory for XRPC endpoints.
proposals/0014-service-auth-revised at main · bluesky-social/proposals
github.com
