atproto-oauth

Implement, debug, and audit AT Proto OAuth flows across Rust, TypeScript, and Go.

46|3|Updated Apr 21, 2026

Search Tags:#oauth #session #dpop #pkce #atproto #par

Ready to run

npx skills add https://github.com/ngerakines/atproto-skills --skill atproto-oauth

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: atproto-oauth
Source: https://github.com/ngerakines/atproto-skills/tree/main/skills/atproto-oauth
Command: npx skills add https://github.com/ngerakines/atproto-skills --skill atproto-oauth

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill provides a comprehensive, cross-language reference and tooling for implementing, auditing, and debugging AT Protocol OAuth flows (PAR, PKCE, DPoP) across Rust, TypeScript, and Go, including dynamic client metadata publication and per-DID session handling.

Core Features & Use Cases

Covers confidential BFF backends, public SPAs, and native clients with end-to-end OAuth workflows.
Includes client metadata publication, DPoP nonce handling, PKCE challenges, and DID-based identity verification across AS/PDS discovery.
Serves as a canonical reference for multi-language interop, key rotation patterns, and security invariants required by the AT Proto OAuth spec.

Quick Start

Start by hosting the metadata endpoint and follow the three principal steps: begin the PAR flow, complete the token exchange on callback, then resume the session to make authenticated requests.

Frequently Asked Questions about atproto-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement AT Protocol OAuth flows with PKCE and DPoP across different programming languages?▼

AT Protocol OAuth implementation across Rust, TypeScript, and Go requires handling PAR, PKCE, and DPoP flows. This Skill provides cross-language reference tooling and canonical workflows ensuring secure interoperability and strict spec compliance for confidential backends, public SPAs, and native clients.

What is DPoP nonce handling and how does it work in ATProto OAuth?▼

DPoP nonce handling in ATProto OAuth provides per-origin proof-of-possession protection during token issuance. This Skill covers explicit nonce management and key handling required by the shared OAuth spec, enabling secure per-DID session management across different client architectures.

How do I set up dynamic client metadata publication for AT Protocol authentication?▼

Setting up dynamic client metadata publication for AT Protocol authentication involves hosting a metadata endpoint before initiating the PAR flow. This Skill guides you through the three principal steps: hosting metadata, beginning the PAR flow, and completing the token exchange on callback to establish authenticated requests.

Can I use AT Proto OAuth with a Backend-For-Frontend (BFF) architecture?▼

Yes, AT Proto OAuth supports confidential BFF backends alongside public SPAs and native clients. This Skill covers end-to-end OAuth workflows tailored for these distinct client types, ensuring secure session management and DPoP protection regardless of your specific application architecture.

Why does my ATProto OAuth token exchange fail due to strict metadata invariants?▼

ATProto OAuth token exchanges fail when strict metadata and flow invariants defined in the shared spec are not met. This Skill helps audit and debug these failures by providing canonical reference patterns for key rotation, explicit key handling, and per-DID identity verification across AS and PDS discovery.