Permissioned Spaces - WG.1

@Permissioned Spaces Expressive Authorization at the PDS @verdverm.com | @blebbit.app

Permissioned Spaces - WG.1

@Permissioned Spaces Expressive Authorization at the PDS @verdverm.com | @blebbit.app

Permissioned Data: Space Access - Nick's Blog

Stepping outside the shapes series for a deep dive: how space configuration decides which people and which apps get credentials. Here be dragons.

OAuth scopes (#3806) · bluesky-social/atproto@1899b1f

* style: prefix `id` and `uri` with `request` where applicable * Dynamically validate OAuth scopes * Allow configuring trusted OAuth clients * Improve client validation * Rework authorization t...

Permission set (#4108) · bluesky-social/atproto@f9dc9aa

* Export constants and type assertion utilities * Add permission set support to oauth provider * improve permission set parsing * Rename `PermissionSet` to `ScopePermissions` * Improve performa...

Lexicons | at-store

Browse verified apps that share repo record collection lexicons from OAuth scopes.

OAuth Roadmap · bluesky-social atproto · Discussion #2656

OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...

OAuth Client Implementation | Bluesky

This is a guide to implementing atproto OAuth clients "The Hard Way." Optimistically, most developers will have an SDK available for their programming language which supports OAuth, and they can simply refer to SDK documentation. This guide is intended for early adopters, SDK maintainers, or developers with more sophisticated OAuth needs. It is agnostic to whether developers are building clients to work the the app.bsky microblogging Lexicons, or implementing novel application Lexicons.

Working OAuth example? · bluesky-social atproto · Discussion #3075

For the last week I've tried to implement ATProto OAuth with Ruby, but it's proven to be very complicated. Although there are numerous existing OAuth libraries, none implement the more mode...

Proposal: OAuth Scopes · bluesky-social atproto · Discussion #3655

Note: a more complete proposal was published in July 2025: https://github.com/bluesky-social/proposals/tree/main/0011-auth-scopes We’re continuing work on rolling OAuth out to the atproto network. ...

OAuth 2.0 DPoP-bound Access Tokens :: Spring Security

RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP) is an application-level mechanism for sender-constraining an access token.

atproto oauth2 vs. createSession, scope problems: (transition:generic vs. com.atproto.access) · bluesky-social atproto · Discussion #3211

Summary: When I authenticate via oauth2 on iPhone (via the blueSky page sheet that springs up ), I get an access token with "atproto transition:generic" scope. But passing that token to u...