Wherein I [try to] answer a seemingly straightforward question: "WTF is OAuth, anyhow?"
The OAuth mechanism and its most common flows
Every single time when you want to sign in to an application and you click on “Login with Google”, you are starting a protocol called…
OAuth API - Home
The Apigee OAuth API gives you a keychain for authenticating to Twitter, Salesforce, Salesforce Chatter, Facebook, Flickr, and Foursquare. Thousands of developers complain about the complexity of using OAuth. Now you can easily authenticate in one consistent way across several APIs and build apps faster.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
OAuth Client ID Metadata Document
This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration. This is through the usage of a URL as a client_id in an OAuth flow, where the URL refers to a document containing the necessary client metadata, enabling the authorization server to fetch the metadata about the client as needed.
OAuth Client ID Metadata Document
This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration. This is through the usage of a URL as a client_id in an OAuth flow, where the URL refers to a document containing the necessary client metadata, enabling the authorization server to fetch the metadata about the client as needed.
OAuth — The Open Standard for Authorization
The open standard for authorization on the web. Find what you need:
OAuth scopes (#3806) · bluesky-social/atproto@1899b1f
* style: prefix `id` and `uri` with `request` where applicable * Dynamically validate OAuth scopes * Allow configuring trusted OAuth clients * Improve client validation * Rework authorization t...
IndieAuth
IndieAuth is a federated login protocol for Web sign-in, enabling users to use their own domain to sign in to other sites and services. IndieAuth can be used to implement OAuth2 login AKA OAuth-based login.
this would be my answer too, atproto oauth is unironically extremely based
hailey
i guess in a way this is the most widely used one, but also one that is severely underused in other ways. definitely identity. i've long been of the opinion that there are obviously cool things that come from public data and all the public pieces of the proto, but identity is higher impact.
I need folks to understand that there are also a LOT of users who prefer app passwords bc OAuth makes them feel uncomfortable.
im'bcmgs'im
surf.social looks amazing but idk about this login experience... i dont normally wanna put my password for one site into another site 🙃
3) it still doesn't fully cover all use cases well or at all 4) bsky.app still didn't manage to implement OAuth at all Yes, we should all be moving to OAuth w/ scopes, that's the goal, but give people some slack, it's all still rather fresh, we'll get there… (yes, it's me, I'm those people)
