two things can be true 1. `transition:generic` is too broad of scope for most atproto apps and users should be aware 2. `transition:generic` is pretty much all we got as atproto devs while more granular oauth scopes are being developed and users are fear mongering too hard too early rn
e(Ag)le 🦅
Clearsky has updated to require authentication when viewing who blocks a user, and the permission scope it's asking for via bsky's oauth is...absolutely wild. Way, way, way too many permission grants there, folks.
Nov 15, 2025 at 11:23 PM
atproto oauth2 vs. createSession, scope problems: (transition:generic vs. com.atproto.access) · bluesky-social atproto · Discussion #3211
Summary: When I authenticate via oauth2 on iPhone (via the blueSky page sheet that springs up ), I get an access token with "atproto transition:generic" scope. But passing that token to u...
shreyan - Nostr and ATProto
This post could’ve been titled “Nostr vs ATProto”, but that really isn’t what I wanted to do here. While I will be comparing and contrasting them a lot, and that’s kind of even the point of writing this, I didn’t want to really pit the two against each other at all, and especially not with the title. I also want to try avoiding commenting on the differences between the communities that have formed on the protocols and their apps, although I definitely will be looking at the philosophical differences between the two a lot - also kind of the point of writing this. This also isn’t a super deep technical post, though it assumes familiarity with technical concepts. I also might come back to edit parts of it and add more later.
shreyan - Nostr and ATProto
This post could’ve been titled “Nostr vs ATProto”, but that really isn’t what I wanted to do here. While I will be comparing and contrasting them a lot, and that’s kind of even the point of writing this, I didn’t want to really pit the two against each other at all, and especially not with the title. I also want to try avoiding commenting on the differences between the communities that have formed on the protocols and their apps, although I definitely will be looking at the philosophical differences between the two a lot - also kind of the point of writing this. This also isn’t a super deep technical post, though it assumes familiarity with technical concepts. I also might come back to edit parts of it and add more later.
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
one thing in the current atproto landscape that worries me a bit is how much (particularly post-oauth) a lot of the ecosystem is starting to build around or assuming patterns where we dont draw a distinction between clients/user-agents vs the rest of an application and where the application backend
now updated my atproto oauth reference from last year! github.com/j4ckxyz/atproto-oauth-referen… - explains why to avoid `transition:generic` AND a skills file for your coding agent!!! github.com/j4ckxyz/atproto-oauth-referen… no reason to not have #atproto oauth anymore!
GitHub - j4ckxyz/atproto-oauth-reference
github.comthis would be my answer too, atproto oauth is unironically extremely based
hailey
i guess in a way this is the most widely used one, but also one that is severely underused in other ways. definitely identity. i've long been of the opinion that there are obviously cool things that come from public data and all the public pieces of the proto, but identity is higher impact.
the point of atproto is to make locked-open apps. apps which are constrained such that they cannot be e.g. bought by billionaires and ruined. yes, doing non-atproto things "enables app developers to do more". yes, non-atproto is "more intuitive" and "it sucks" when you hit atproto's limits.
some thoughts on atproto as a post-app paradigm
Ecosystem Plugins
notes.wesleyfinck.org
