







"As an ActivityPub API client developer, I need a standard profile of OAuth to use for authorising my app to API servers, so I don't have to create custom code for every different API serv...

OAuth Client Implementation | Bluesky
This is a guide to implementing atproto OAuth clients "The Hard Way." Optimistically, most developers will have an SDK available for their programming language which supports OAuth, and they can simply refer to SDK documentation. This guide is intended for early adopters, SDK maintainers, or developers with more sophisticated OAuth needs. It is agnostic to whether developers are building clients to work the the app.bsky microblogging Lexicons, or implementing novel application Lexicons.

Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
OAuth for ATProto Apps Part 2: Mobile Implementation - Lost in Inference
Part 2 of a 2-part series on implementing OAuth authentication for ATProto (Bluesky) applications.
OAuth API - Home
The Apigee OAuth API gives you a keychain for authenticating to Twitter, Salesforce, Salesforce Chatter, Facebook, Flickr, and Foursquare. Thousands of developers complain about the complexity of using OAuth. Now you can easily authenticate in one consistent way across several APIs and build apps faster.
ActivityPub Client API: A Way Forward | Steve Bate
The ActivityPub Client-to-Server (C2S) protocol was envisioned as a cornerstone of the decentralized social web, along with the Server-to-Server (S2S) protocol. Standardized by the W3C in 2018, C2S defines how user-facing applications, such as mobile apps or web clients, and bots should interact with social servers using Activity Streams 2.0 and JSON-LD. In theory, it ... Read more

Working OAuth example? · bluesky-social atproto · Discussion #3075
For the last week I've tried to implement ATProto OAuth with Ruby, but it's proven to be very complicated. Although there are numerous existing OAuth libraries, none implement the more mode...
OAuth for AT Protocol | Bluesky
We are very happy to release the initial specification of OAuth for AT Protocol! This is expected to be the primary authentication and authorization system between atproto client apps and PDS instances going forward, replacing the current flow using App Passwords and createSession over time.

index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
Building a Browser-Based ATProtocol OAuth App with Supporter Validation - ATProtoFans Blog
ATProto User Intents Demo
This is a demo tool which allows atproto accounts to configure a reuse declaration for their public data. You can read more about this atproo mechanism in the "User Intents for Data Reuse" proposal from March 2025. Any account in the atproto network (including Bluesky accounts) can use this tool via OAuth. The source code for this demo is linked above.
hello please steal this atproto #idea so i don’t have to do it: community lexicon for social / web identities verified via oauth - user logs into their tiktok / meta / orcid / whatever account via associated official oauth - app stores the id, username, whatever else might be useful, date
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm
Paul Rohr
TL/DR = yes, it's a subtle conceptual shift: - from app-centric (apps control identity/data, delegating access to you at signin) - to identity-centric (you control identity/data, delegating access to apps at signin) Really looking forward to how the team evolves the OAuth UX to address this! /END
I'm certainly not against saying what I think AT Protocol has wrong. github.com/swicg/activitypub-api/issues/…