i think we need to do a permission sets push... permission sets are mainly for giving nice human-readable, user-friendly descriptions of resources! if your OAuth screen looks like this, consider publishing/using permission sets. this is scary/useless/non-sensical to users
Sep 23, 2026 at 7:42 PM
Permission set (#4108) · bluesky-social/atproto@f9dc9aa
* Export constants and type assertion utilities * Add permission set support to oauth provider * improve permission set parsing * Rename `PermissionSet` to `ScopePermissions` * Improve performa...
Scope Builder - AT Protocol Docs - AT Protocol
Interactive tool for building OAuth scope strings and permission sets.
How to handle granular permissions | Authorization Resources | Google for Developers
Granular permissions give users more control over the specific data they share with apps, improving transparency, security, and trust.
Early Permission Sets · bluesky-social atproto · Discussion #4437
Progress is coming along on "Permission Sets", as part of the atproto OAuth and permission system. As with other parts of the protocol, seeing how this functionality gets implemented for ...
atproto made simple: granular permissions - underreacted
you're working on an atproto app that needs to write some records to your own collection like app.example.post or app.example.like. you're already using OAu…
Permissioned Data Diary 6: Boring Auth - Daniel's Leaflets
In which we resist the temptation to invent a clever authorization model & pick the boring one instead.
What is OAuth?
Wherein I [try to] answer a seemingly straightforward question: "WTF is OAuth, anyhow?"
3) it still doesn't fully cover all use cases well or at all 4) bsky.app still didn't manage to implement OAuth at all Yes, we should all be moving to OAuth w/ scopes, that's the goal, but give people some slack, it's all still rather fresh, we'll get there… (yes, it's me, I'm those people)
Implementing dynamic OAuth scoping so that people who don't want to give any Bluesky permissions can still log in to Streamplace. Do I gotta implement a totally separate metadata document? Currently we're at stream.place/oauth/upstream/client-metadat… but that has the scope inline... cc @thisismissem.social
We know picking the right OAuth scopes can be confusing, so we built a tool to help with that. Grab the proper scopes and permission sets from apps across the ecosystem with our new Scope Builder.
Scope Builder - AT Protocol Docs - AT Protocol
atproto.com#atdev spent like 3h yesterday trying to make oauth permissions sets pretty only to hit a wall bc i need bsky to have more published sets bc everything is a huge overgrant 😌
while we're here, here's how i wish permission sets were explained to me
atproto made simple: granular permissions
underreacted.leaflet.pubWe know picking the right OAuth scopes can be confusing, so we built a tool to help with that. Grab the proper scopes and permission sets from apps across the ecosystem with our new Scope Builder.
Scope Builder - AT Protocol Docs - AT Protocol
atproto.com
