What is OAuth?
Wherein I [try to] answer a seemingly straightforward question: "WTF is OAuth, anyhow?"
OAuth API - Home
The Apigee OAuth API gives you a keychain for authenticating to Twitter, Salesforce, Salesforce Chatter, Facebook, Flickr, and Foursquare. Thousands of developers complain about the complexity of using OAuth. Now you can easily authenticate in one consistent way across several APIs and build apps faster.
Oauth scopes vs record permissions
i hope this is an alright place to put this, but it was just a thought i had inspired by this tweet even with oauth scopes, i think that interoperability between applications is a tough problem because i have to fully trust every oauth client that i use with access to record namespaces. so if i have existing bluesky records, and then i want to use a different application which wants to be able to create and delete bluesky records, either i can’t use bluesky features in that application, or i ne...
PDS: review existing oauth scopes via connected apps list · Issue #4838 · bluesky-social/atproto
Scenario I want to stay on top of which apps are messing with what in my PDS. To do so, it's not enough to just make a granular Goldilocks decision once per app. (The more apps I use, the fewer...
Scope Builder - AT Protocol Docs - AT Protocol
Interactive tool for building OAuth scope strings and permission sets.
Building OAuth Authentication for Bluesky: A Complete Guide for Web and iOS Apps - Lost in Inference
How to implement secure, standards-compliant OAuth 2.1 + PKCE authentication for AT Protocol apps with separate web and mobile flows
Using OAuth 2.0 for Web Server Applications | Authorization | Google for Developers
Web server applications can use Google API Client Libraries or Google OAuth 2.0 endpoints for OAuth 2.0 authorization to access Google APIs.
We know picking the right OAuth scopes can be confusing, so we built a tool to help with that. Grab the proper scopes and permission sets from apps across the ecosystem with our new Scope Builder.
Scope Builder - AT Protocol Docs - AT Protocol
atproto.comI need folks to understand that there are also a LOT of users who prefer app passwords bc OAuth makes them feel uncomfortable.
im'bcmgs'im
surf.social looks amazing but idk about this login experience... i dont normally wanna put my password for one site into another site 🙃
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm
Paul Rohr
TL/DR = yes, it's a subtle conceptual shift: - from app-centric (apps control identity/data, delegating access to you at signin) - to identity-centric (you control identity/data, delegating access to apps at signin) Really looking forward to how the team evolves the OAuth UX to address this! /END
does anyone use the email scope for their atproto app? can scopes be made to be optional for users? should I just have users input their email after authenticating for if they want email updates and notifications?
OAuth - AT Protocol
atproto.comWe know picking the right OAuth scopes can be confusing, so we built a tool to help with that. Grab the proper scopes and permission sets from apps across the ecosystem with our new Scope Builder.
Scope Builder - AT Protocol Docs - AT Protocol
atproto.com3) it still doesn't fully cover all use cases well or at all 4) bsky.app still didn't manage to implement OAuth at all Yes, we should all be moving to OAuth w/ scopes, that's the goal, but give people some slack, it's all still rather fresh, we'll get there… (yes, it's me, I'm those people)
I've been saying for nearly a year that getting the UX right for bsky's OAuth deployment is a major inflection point for reinforcing users mental models If we phrase things right, people will learn that this password UX controls access to my identity + slices of my atmosphere data (via my PDS)
Paul Rohr
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm
