it's been a hot minute, but atex v0.10.0 is out now! oauth internals got a bit of a refactor, :telemetry events have been added to XRPC, identity resolution, OAuth flows, and service auth validation, and XRPC requests now have a custom User-Agent! #atproto #elixir
comet.sh/atex
tangled.orgJun 29, 2026 at 1:52 PM
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
Authenticated XRPC Calls in Lexicon Garden - Nick's Blog
ATProtocol OAuth pairs effortlessly with Lexicon Garden to make it easy for developers to experiment with authenticated XRPC endpoints.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
Building AIP: An ATProtocol Authorization Gateway - Nick's Blog
OAuth is the first challenge developers face in the atmosphere. This post is about AIP, the authorization gateway we built at Graze Social to alleviate some of the pain.
Let's fix OAuth in MCP
Update: The changes described in this blog post have been incorporated into the 2025-06-18 version of the MCP spec!
tijs/atproto-oauth
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
I've been digging deep into what Elixir atproto OAuth can look like. This is not the final version yet, but it's starting to shape up. blog.annot.at/side-quest-an-elixir-atproto-…
Side-quest: An Elixir atproto OAuth library
blog.annot.atXRPC requests between atproto servers are authenticated using JWTs. There are some inconsistencies in how OAuth permissions, PDS proxy headers, and JWTs all represent the "audience" of these tokens. This proposal gives background and describes a rough solution. Looking for rapid feedback!
proposals/0013-service-auth-refs at main · bluesky-social/proposals
github.comHey @surf.social the atproto early adopter / tech community can’t recommend you until you implement OAuth. This is a pretty big user security issue. Let us know if you need help or contract @thisismissem.social
im'bcmgs'im
surf.social looks amazing but idk about this login experience... i dont normally wanna put my password for one site into another site 🙃
I think I found an issue with the existing Bluesky OAuth permission sets @matthieu.bsky.team @bnewbold.net: github.com/bluesky-social/atproto/issues…. The XRPC endpoints specified in `authViewAll` are inconsistent about aud. Minimal repro here. tangled.org/tylerjfisher.com/repro-bluesk… Might be doing something wrong, lmk!
Bluesky permission sets require inconsistent aud parameter · Issue #4850 · bluesky-social/atproto
github.com
