I hope @dholms.at or someone else at @bsky.app considers this before it's too late and ACLs are baked into the protocol.
Authority as Possession: Permissioned Spaces Deserve Better Than ACLs
leaflet.pubApr 9, 2026 at 7:31 AM
OAuth for AT Protocol | Bluesky
We are very happy to release the initial specification of OAuth for AT Protocol! This is expected to be the primary authentication and authorization system between atproto client apps and PDS instances going forward, replacing the current flow using App Passwords and createSession over time.
ACLs don't
The ACL model is unable to make correct access decisions for interactions involving more than two principals, since required information is not retained across message sends. Though this deficiency has long been documented in the published literature, it is not widely understood. This logic error in the ACL model is exploited by both the clickjacking and Cross-Site Request Forgery attacks that affect many Web applications.
Building OAuth Authentication for Bluesky: A Complete Guide for Web and iOS Apps - Lost in Inference
How to implement secure, standards-compliant OAuth 2.1 + PKCE authentication for AT Protocol apps with separate web and mobile flows
tijs/atproto-oauth
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications
Proposal: OAuth Scopes · bluesky-social atproto · Discussion #3655
Note: a more complete proposal was published in July 2025: https://github.com/bluesky-social/proposals/tree/main/0011-auth-scopes We’re continuing work on rolling OAuth out to the atproto network. ...
Updated Auth Scopes Proposal · bluesky-social atproto · Discussion #4013
This is a discussion thread for the July 2025 Auth Scopes proposal
The AT Protocol | Bluesky
The AT Protocol (Authenticated Transfer Protocol, or atproto) is a standard for public conversation and an open-source framework for building social apps.
Progress on Auth Scopes Implementation (August 2025) · bluesky-social atproto · Discussion #4118
Since our last update on Auth Scopes, the Bluesky team has been hard at work adding support to our reference PDS implementation. Aspects of this work are starting to roll out in the production netw...
For our next Off Protocol Live, we're doing a permissioned data AMA with @dholms.at. Reply to this thread with your questions and tune into the livestream for more.
Off Protocol LIVE — Permissioned Data AMA
atmo.rsvpPermission sets for bsky launched sometime early this year (and still have issues github.com/bluesky-social/atproto/issues…, github.com/bluesky-social/atproto/discus…). XRPC scopes were earlier, but as far as user communication goes it's not any better. Requesting one XRPC scope still looks scary for end users.
I love to see when a *.host.bsky.network (mushroom PDS) user is informed in a nice, polite way about how the AT Protocol works and why it's awesome.
@bsky.app recently acquired the trademark for AT Protocol (and variants) to help protect the ecosystem. Here’s more about what that means. atproto.com/blog/at-protocol-trademark
AT Protocol Trademark
atproto.com
