at the moment they are somewhat far apart (for one it currently has its own PoP mechanism with its own nonces, etc.), but it is still possible! there is a discussion here: github.com/oauth-wg/draft-ietf-oauth-att…
Similar proposal in AT Protocol: DPoP-bound private_key_jwt client authentication · Issue #123 · oauth-wg/draft-ietf-oauth-attestation-based-client-auth
github.comFeb 13, 2026 at 10:20 PM
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
What is OAuth?
Wherein I [try to] answer a seemingly straightforward question: "WTF is OAuth, anyhow?"
tijs/atproto-oauth
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications
OAuth for AT Protocol | Bluesky
We are very happy to release the initial specification of OAuth for AT Protocol! This is expected to be the primary authentication and authorization system between atproto client apps and PDS instances going forward, replacing the current flow using App Passwords and createSession over time.
Enterprise-Managed Authorization: Zero-touch OAuth for MCP
The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth.
Proposal: OAuth-based account creation · bluesky-social atproto · Discussion #4587
We recently added to the reference PDS (and underlying OAuth Provider) implementation support for Initiating User Registration via OpenID Connect 1.0, however, what I wasn't aware of when I add...
PDS: review existing oauth scopes via connected apps list · Issue #4838 · bluesky-social/atproto
Scenario I want to stay on top of which apps are messing with what in my PDS. To do so, it's not enough to just make a granular Goldilocks decision once per app. (The more apps I use, the fewer...
Cross-App Authentication on AT Protocol
We recently built cross-app authentication between Roomy and OpenMeet using AT Protocol service auth JWTs. The idea came from @erlend.sh (his writeup), @zicklag.dev introduced me to PDS service auth, and @meri.garden contributed reviews. I made the implementation in both apps: A user logs into Roomy, navigates to an OpenMeet event, and is silently authenticated and able to use their account on OpenMeet without a second login. Full technical writeup: Cross-App Authentication on AT Protocol I’m ...
OAuth API - Home
The Apigee OAuth API gives you a keychain for authenticating to Twitter, Salesforce, Salesforce Chatter, Facebook, Flickr, and Foursquare. Thousands of developers complain about the complexity of using OAuth. Now you can easily authenticate in one consistent way across several APIs and build apps faster.
Cirrus (my single-user PDS than runs in a Cloudflare Worker) now supports granular OAuth scopes and permission sets. github.com/ascorbic/cirrus
Cirrus (my single-user PDS than runs in a Cloudflare Worker) now supports granular OAuth scopes and permission sets. github.com/ascorbic/cirrus
