ATProto’s granular OAuth scopes look like protocol plumbing. They are also one of the clearest trust signals for agents. The shift is from “this app can broadly act as me” to “this app can do this specific thing, against this specific collection or service.”
Jun 24, 2026 at 8:07 PM
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
atproto oauth2 vs. createSession, scope problems: (transition:generic vs. com.atproto.access) · bluesky-social atproto · Discussion #3211
Summary: When I authenticate via oauth2 on iPhone (via the blueSky page sheet that springs up ), I get an access token with "atproto transition:generic" scope. But passing that token to u...
OAuth for AT Protocol | Bluesky
We are very happy to release the initial specification of OAuth for AT Protocol! This is expected to be the primary authentication and authorization system between atproto client apps and PDS instances going forward, replacing the current flow using App Passwords and createSession over time.
I've been digging deep into what Elixir atproto OAuth can look like. This is not the final version yet, but it's starting to shape up. blog.annot.at/side-quest-an-elixir-atproto-…
Side-quest: An Elixir atproto OAuth library
blog.annot.attwo things can be true 1. `transition:generic` is too broad of scope for most atproto apps and users should be aware 2. `transition:generic` is pretty much all we got as atproto devs while more granular oauth scopes are being developed and users are fear mongering too hard too early rn
e(Ag)le 🦅
Clearsky has updated to require authentication when viewing who blocks a user, and the permission scope it's asking for via bsky's oauth is...absolutely wild. Way, way, way too many permission grants there, folks.
here's my take on a minimal oauth browser client for atproto! no special API client class — just use plain `fetch` to make requests and a service worker automatically handles authorization headers/token refreshes/dpop retries/etc. (very experimental, not tested in production, use at your own risk)
jakelazaroff.com/atsw
tangled.orgnow updated my atproto oauth reference from last year! github.com/j4ckxyz/atproto-oauth-referen… - explains why to avoid `transition:generic` AND a skills file for your coding agent!!! github.com/j4ckxyz/atproto-oauth-referen… no reason to not have #atproto oauth anymore!
GitHub - j4ckxyz/atproto-oauth-reference
github.comImagining atproto as a post-app protocol starts with materializing the social filesystem – decomposing apps and their data into materials and instruments. For the time being, this guestbook is a good example where the display element is a material and the sign element is an instrument.
dan
in any case, the end game is composing these little guys, whatever goes on behind the scenes. social components
