I think I found an issue with the existing Bluesky OAuth permission sets @matthieu.bsky.team @bnewbold.net: github.com/bluesky-social/atproto/issues…. The XRPC endpoints specified in `authViewAll` are inconsistent about aud. Minimal repro here. tangled.org/tylerjfisher.com/repro-bluesk… Might be doing something wrong, lmk!
Bluesky permission sets require inconsistent aud parameter · Issue #4850 · bluesky-social/atproto
github.comApr 13, 2026 at 1:56 PM
Bluesky permission sets require inconsistent aud parameter · Issue #4850 · bluesky-social/atproto
Describe the bug In trying to rewrite sill.social to use granular permission sets, I've found that app.bsky.authViewAll does not allow access to app.bsky.feed.getFeedGenerator, app.bsky.graph.g...
Bluesky social oauth scope "Bad token scope"
I'm trying to build an app that integrates with bsky's OAuth and API. Using the below the document using the "Browser App" option. https://docs.bsky.app/docs/advanced-guides/oauth-client ...
How I Implemented OAuth for Bluesky in a Next.js App
OAuth is a standard, but every platform has its quirks. When Bluesky released their OAuth...
Bluesky SSH Authentication #2
Addressing the glaring omissions from yesterday’s proof of concept, such as the fact that you could sign in as any user, you couldn’t revoke access, all hosts had the same users, and there was no mapping between Bluesky handles and POSIX users, I have updated mtelvers/bluesky-ssh-key-extractor and newly published mtelvers/bluesky-collection.
Building OAuth Authentication for Bluesky: A Complete Guide for Web and iOS Apps - Lost in Inference
How to implement secure, standards-compliant OAuth 2.1 + PKCE authentication for AT Protocol apps with separate web and mobile flows
your app can run its own pds - keith.is
if you’re building on atproto, you’ve probably reached for “sign in with bluesky” as your auth story. it works! the OAuth flow is fine. but every time a user shows up without a bluesky account, you have to send them to bluesky first, watch them get confused by a totally different brand, and hope they come back. that’s a weird seam in your own product.
Progress on Auth Scopes Implementation (August 2025) · bluesky-social atproto · Discussion #4118
Since our last update on Auth Scopes, the Bluesky team has been hard at work adding support to our reference PDS implementation. Aspects of this work are starting to roll out in the production netw...
app.bsky.actor.getProfile | Bluesky
*This endpoint is part of the Bluesky application Lexicon APIs (`app.bsky.*`). Public endpoints which don't require authentication can be made directly against the public Bluesky AppView API: https://public.api.bsky.app. Authenticated requests are usually proxied via the user's PDS, using service proxy headers. Authenticated requests can be used for both public and non-public endpoints.*
X users are fleeing to Bluesky: Here’s a quick-start guide on how to sign up
Everything you need to know to get started on Bluesky.
Permission sets for bsky launched sometime early this year (and still have issues github.com/bluesky-social/atproto/issues…, github.com/bluesky-social/atproto/discus…). XRPC scopes were earlier, but as far as user communication goes it's not any better. Requesting one XRPC scope still looks scary for end users.
XRPC requests between atproto servers are authenticated using JWTs. There are some inconsistencies in how OAuth permissions, PDS proxy headers, and JWTs all represent the "audience" of these tokens. This proposal gives background and describes a rough solution. Looking for rapid feedback!
proposals/0013-service-auth-refs at main · bluesky-social/proposals
github.comThe frustrating thing about this is that when you "Login with Bluesky", you're not even actually logging in with Bluesky The App. You may be using a Bluesky PBC-hosted PDS, but it has nothing to do with @bsky.app, other than it's the PDS you're assigned when you create an account on their client.
Hi, I hear you on this. There's a longstanding issue with Bluesky's more granular permission sets I'm hoping to get resolved, which is blocking Sill from implementing a better set of permissions. github.com/bluesky-social/atproto/issues…
Bluesky permission sets require inconsistent aud parameter · Issue #4850 · bluesky-social/atproto
github.comreminder that you can always revoke oauth access at bsky.social/account (also a good place to check for apps you forgot you logged in to !)
