one thing in the current atproto landscape that worries me a bit is how much (particularly post-oauth) a lot of the ecosystem is starting to build around or assuming patterns where we dont draw a distinction between clients/user-agents vs the rest of an application and where the application backend
Nov 3, 2026 at 8:17 PM
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
Beyond the Statusphere: Part 2, ATProto OAuth, the TLDR - Hitchhiker's Guide to the Atmosphere
Gain a working knowledge of ATProto OAuth and feel confident implementing it in your projects.
Beyond the Statusphere: Part 2, ATProto OAuth, the TLDR - Hitchhiker's Guide to the Atmosphere
Gain a working knowledge of ATProto OAuth and feel confident implementing it in your projects.
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
some thoughts on atproto as a post-app paradigm
Ecosystem Plugins
notes.wesleyfinck.orgsome thoughts on atproto as a post-app paradigm
Ecosystem Plugins
notes.wesleyfinck.orgI still think the biggest perk of atproto for everyday devs is not the decentralization, but things like - Handles auth, with good standards to check that auth and build permission layers. - A free public key/value database. - Can build api clients and some of the backend with lexicon schemas
this would be my answer too, atproto oauth is unironically extremely based
hailey
i guess in a way this is the most widely used one, but also one that is severely underused in other ways. definitely identity. i've long been of the opinion that there are obviously cool things that come from public data and all the public pieces of the proto, but identity is higher impact.
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm
Paul Rohr
TL/DR = yes, it's a subtle conceptual shift: - from app-centric (apps control identity/data, delegating access to you at signin) - to identity-centric (you control identity/data, delegating access to apps at signin) Really looking forward to how the team evolves the OAuth UX to address this! /END
two things can be true 1. `transition:generic` is too broad of scope for most atproto apps and users should be aware 2. `transition:generic` is pretty much all we got as atproto devs while more granular oauth scopes are being developed and users are fear mongering too hard too early rn
e(Ag)le 🦅
Clearsky has updated to require authentication when viewing who blocks a user, and the permission scope it's asking for via bsky's oauth is...absolutely wild. Way, way, way too many permission grants there, folks.
