Before running these tests, make sure you're on a device that supports Web Authentication, or alternatively use browser DevTools to setup a virtual authenticator in Chrome, or similar in Safari, or this Firefox add-on.
Arbiter Simulator
Interactive simulator for the Arbiter authorization system — design and test auth structures in the browser.
Building OAuth Authentication for Bluesky: A Complete Guide for Web and iOS Apps - Lost in Inference
How to implement secure, standards-compliant OAuth 2.1 + PKCE authentication for AT Protocol apps with separate web and mobile flows
The OAuth mechanism and its most common flows
Every single time when you want to sign in to an application and you click on “Login with Google”, you are starting a protocol called…
Verifying your browser | OpenReview
Verifying your browser | OpenReview
Pilcrow's auth book
Pilcrow's collection of guides, recommendations, and examples for implementing auth in web applications.
index.html · by atprotofans.com
An browser-side ATProtocol OAuth application with no dependencies that verifies supporters
Firefox WebDriver Newsletter 145
WebDriver is a remote control interface that enables introspection and control of user agents. As such it can help developers to verify that their websites are working and performing well with all major browsers. The protocol is standardized by the W3C and consists of two separate specifications: WebDriver classic (HTTP) and the new WebDriver BiDi (Bi-Directional).
Building OAuth Authentication for ATProto apps: Part 1, the web use-case - Building on atproto
In this follow-up OAuth implementation guide I dive a bit deeper into the actual implementation details of building authentication for your web or mobile app that builds on top of ATProto.
Building a Browser-Based ATProtocol OAuth App with Supporter Validation - ATProtoFans Blog
High Performance Browser Networking (O'Reilly)
What every web developer must know about mobile networks, protocols, and APIs provided by browser to deliver the best user experience.
Cross-App Authentication on AT Protocol
We recently built cross-app authentication between Roomy and OpenMeet using AT Protocol service auth JWTs. The idea came from @erlend.sh (his writeup), @zicklag.dev introduced me to PDS service auth, and @meri.garden contributed reviews. I made the implementation in both apps: A user logs into Roomy, navigates to an OpenMeet event, and is silently authenticated and able to use their account on OpenMeet without a second login. Full technical writeup: Cross-App Authentication on AT Protocol I’m ...
🦫 alert! We published the second episode of "Teach the Web new Tricks", featuring native support for @atproto.com ! Learn more how we improve user agency and privacy at webbeef.org/atproto.html : - Native at:// protocol support. - Log in your PDS and forget OAuth ! - Authorize 3rd parties
at the moment they are somewhat far apart (for one it currently has its own PoP mechanism with its own nonces, etc.), but it is still possible! there is a discussion here: github.com/oauth-wg/draft-ietf-oauth-att…
Similar proposal in AT Protocol: DPoP-bound private_key_jwt client authentication · Issue #123 · oauth-wg/draft-ietf-oauth-attestation-based-client-auth
github.com
