there’s a reason why i added this informational box to the sign in flow for @anisota.net — i wanted to make it clearer that the user is redirected away from anisota and to their own account/PDS… and that anisota isn’t getting their password helps that anisota’s design is SO diff from the oauth page
Kuba Suder 🇵🇱🇺🇦
I think Bluesky and #atdev community have some education work to do on the OAuth front, because some people seem to feel that OAuth is less secure than app passwords (see questions to Clearsky: why can't you just use app passwords like everyone else, why do I need to give you my real password etc.)
Nov 17, 2025 at 3:11 PM
Let's fix OAuth in MCP
Update: The changes described in this blog post have been incorporated into the 2025-06-18 version of the MCP spec!
your app can run its own pds - keith.is
if you’re building on atproto, you’ve probably reached for “sign in with bluesky” as your auth story. it works! the OAuth flow is fine. but every time a user shows up without a bluesky account, you have to send them to bluesky first, watch them get confused by a totally different brand, and hope they come back. that’s a weird seam in your own product.
Cross-App Authentication on AT Protocol
We recently built cross-app authentication between Roomy and OpenMeet using AT Protocol service auth JWTs. The idea came from @erlend.sh (his writeup), @zicklag.dev introduced me to PDS service auth, and @meri.garden contributed reviews. I made the implementation in both apps: A user logs into Roomy, navigates to an OpenMeet event, and is silently authenticated and able to use their account on OpenMeet without a second login. Full technical writeup: Cross-App Authentication on AT Protocol I’m ...
New authentication flow for Sill - Euphonos
Sill no longer requires an email for signup
reminder: the biggest atmosphere app in existence (bluesky) does not even have OAuth yet and has total access to your account scopes will come to @anisota.net, but it’s gonna take a bit longer & the lack of scopes is not due to forgetfulness or low quality… scopes didn’t exist when i made anisota
I've been saying for nearly a year that getting the UX right for bsky's OAuth deployment is a major inflection point for reinforcing users mental models If we phrase things right, people will learn that this password UX controls access to my identity + slices of my atmosphere data (via my PDS)
Paul Rohr
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm
🦫 alert! We published the second episode of "Teach the Web new Tricks", featuring native support for @atproto.com ! Learn more how we improve user agency and privacy at webbeef.org/atproto.html : - Native at:// protocol support. - Log in your PDS and forget OAuth ! - Authorize 3rd parties
A month ago we added basic support for @leaflet.pub documents within Anisota. Today we're excited to expand our @leaflet.pub support in 2 ways: 1. Rich author info for Leaflet URLs 2. Leaflet URLs now go to Anisota's view of the doc Try: anisota.net/profile/pfrazee.com/post/3m5h…
This is awesome. I made a PR last week to add better support and display for permission-sets to the OAuth consent screen for @tranquil.farm. Now every time I log in to my Atmosphere account, I can actually see my fingerprints on Tranquil. 😍 #atproto
This is awesome. I made a PR last week to add better support and display for permission-sets to the OAuth consent screen for @tranquil.farm. Now every time I log in to my Atmosphere account, I can actually see my fingerprints on Tranquil. 😍 #atproto
Hey @surf.social the atproto early adopter / tech community can’t recommend you until you implement OAuth. This is a pretty big user security issue. Let us know if you need help or contract @thisismissem.social
im'bcmgs'im
surf.social looks amazing but idk about this login experience... i dont normally wanna put my password for one site into another site 🙃
