Run confidential AT Protocol OAuth clients on local domains without a tunnel.
socialdept/protobroker
Run confidential AT Protocol OAuth clients on local domains without a tunnel
tijs/atproto-oauth
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications
Cross-App Authentication on AT Protocol
We recently built cross-app authentication between Roomy and OpenMeet using AT Protocol service auth JWTs. The idea came from @erlend.sh (his writeup), @zicklag.dev introduced me to PDS service auth, and @meri.garden contributed reviews. I made the implementation in both apps: A user logs into Roomy, navigates to an OpenMeet event, and is silently authenticated and able to use their account on OpenMeet without a second login. Full technical writeup: Cross-App Authentication on AT Protocol I’m ...
OAuth for AT Protocol | Bluesky
We are very happy to release the initial specification of OAuth for AT Protocol! This is expected to be the primary authentication and authorization system between atproto client apps and PDS instances going forward, replacing the current flow using App Passwords and createSession over time.
OAuth Roadmap · bluesky-social atproto · Discussion #2656
OAuth is nigh! Protocol support has been a long time coming and we are pumped. It should greatly improve the user and developer experiences building secure apps and integrations on atproto. And cou...
Secure MCP Tunnel | OpenAI API
Connect private or on-prem MCP servers to supported OpenAI products with an outbound-only MCP tunnel, without exposing them to the public internet.
@atproto/oauth-client-node - AT Protocol
Node.js OAuth client for AT Protocol with built-in crypto and storage
sparrowtek.com/atproto-auth-proxy
Stateless auth proxy that converts AT Protocol native apps from public to confidential OAuth clients. Deploy once, get 180-day refresh tokens instead of 24-hour ones.
sparrowtek.com/atproto-auth-proxy
Stateless auth proxy that converts AT Protocol native apps from public to confidential OAuth clients. Deploy once, get 180-day refresh tokens instead of 24-hour ones.
PDS: review existing oauth scopes via connected apps list · Issue #4838 · bluesky-social/atproto
Scenario I want to stay on top of which apps are messing with what in my PDS. To do so, it's not enough to just make a granular Goldilocks decision once per app. (The more apps I use, the fewer...
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
at the moment they are somewhat far apart (for one it currently has its own PoP mechanism with its own nonces, etc.), but it is still possible! there is a discussion here: github.com/oauth-wg/draft-ietf-oauth-att…
Similar proposal in AT Protocol: DPoP-bound private_key_jwt client authentication · Issue #123 · oauth-wg/draft-ietf-oauth-attestation-based-client-auth
github.comXRPC requests between atproto servers are authenticated using JWTs. There are some inconsistencies in how OAuth permissions, PDS proxy headers, and JWTs all represent the "audience" of these tokens. This proposal gives background and describes a rough solution. Looking for rapid feedback!
proposals/0013-service-auth-refs at main · bluesky-social/proposals
github.com
