two things can be true 1. `transition:generic` is too broad of scope for most atproto apps and users should be aware 2. `transition:generic` is pretty much all we got as atproto devs while more granular oauth scopes are being developed and users are fear mongering too hard too early rn
e(Ag)le 🦅
Clearsky has updated to require authentication when viewing who blocks a user, and the permission scope it's asking for via bsky's oauth is...absolutely wild. Way, way, way too many permission grants there, folks.
Nov 15, 2025 at 11:23 PM
atproto oauth2 vs. createSession, scope problems: (transition:generic vs. com.atproto.access) · bluesky-social atproto · Discussion #3211
Summary: When I authenticate via oauth2 on iPhone (via the blueSky page sheet that springs up ), I get an access token with "atproto transition:generic" scope. But passing that token to u...
shreyan - Nostr and ATProto
This post could’ve been titled “Nostr vs ATProto”, but that really isn’t what I wanted to do here. While I will be comparing and contrasting them a lot, and that’s kind of even the point of writing this, I didn’t want to really pit the two against each other at all, and especially not with the title. I also want to try avoiding commenting on the differences between the communities that have formed on the protocols and their apps, although I definitely will be looking at the philosophical differences between the two a lot - also kind of the point of writing this. This also isn’t a super deep technical post, though it assumes familiarity with technical concepts. I also might come back to edit parts of it and add more later.
shreyan - Nostr and ATProto
This post could’ve been titled “Nostr vs ATProto”, but that really isn’t what I wanted to do here. While I will be comparing and contrasting them a lot, and that’s kind of even the point of writing this, I didn’t want to really pit the two against each other at all, and especially not with the title. I also want to try avoiding commenting on the differences between the communities that have formed on the protocols and their apps, although I definitely will be looking at the philosophical differences between the two a lot - also kind of the point of writing this. This also isn’t a super deep technical post, though it assumes familiarity with technical concepts. I also might come back to edit parts of it and add more later.
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
PDS: review existing oauth scopes via connected apps list · Issue #4838 · bluesky-social/atproto
Scenario I want to stay on top of which apps are messing with what in my PDS. To do so, it's not enough to just make a granular Goldilocks decision once per app. (The more apps I use, the fewer...
Taproot - AT Protocol Explorer gets an upgrade - atproto.at
Taproot All-in-one ATProto Explorer - atproto.at
now updated my atproto oauth reference from last year! github.com/j4ckxyz/atproto-oauth-referen… - explains why to avoid `transition:generic` AND a skills file for your coding agent!!! github.com/j4ckxyz/atproto-oauth-referen… no reason to not have #atproto oauth anymore!
GitHub - j4ckxyz/atproto-oauth-reference
github.comsome thoughts on atproto as a post-app paradigm
Ecosystem Plugins
notes.wesleyfinck.orgthe point of atproto is to make locked-open apps. apps which are constrained such that they cannot be e.g. bought by billionaires and ruined. yes, doing non-atproto things "enables app developers to do more". yes, non-atproto is "more intuitive" and "it sucks" when you hit atproto's limits.
There are two theories-of-change emerging: displace vs. integrate They are by no means mutually exclusive, but much more effort has gone into spinning up brand new atproto apps with the goal to displace existing apps than has gone into embedding the protocol into every nook and cranny of the web.
patak
adding social features to our websites will accelerate atproto adoption faster than building pure atproto apps
Hot take but I think it’s problematic for atproto that lots of developers i see talking about making stuff focus mostly on things absolutely no end user gives a shit about to fuel their protocols and architecture fetish, and it’s a failure there isn’t another app with like 100k+ users active even.
