skills.rest
hypercerts-org
hypercerts-orgOFFICIAL
Explore all skills by this author →
Website𝕏@hypercertsGitHub

epds-login

Enable passwordless AT Protocol login against ePDS using OAuth with PAR/DPoP flows.

8|4|Updated Feb 20, 2026
Search Tags:#oauth#otp#passwordless#dpop#pkce#at-protocol#epds
One-click install
npx skills add https://github.com/hypercerts-org/ePDS --skill epds-login
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: epds-login
Source: https://github.com/hypercerts-org/ePDS/tree/main/.agents/skills/epds-login
Command: npx skills add https://github.com/hypercerts-org/ePDS --skill epds-login

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Enable passwordless login against an ePDS instance using AT Protocol OAuth, handling PKCE, DPoP, and token exchanges to provision a user identity without passwords across Flow 1 and Flow 2.

Core Features & Use Cases

  • Two flows supported: Flow 1 uses hand-rolled PAR/DPoP with an email login_hint, Flow 2 uses @atproto/oauth-client-node to automate PAR/DPoP and handle inputs like no identifier, a handle, or a DID.
  • Reference implementation guidance is available in the ePDS repository (packages/demo) showing client metadata, flow integration, and interaction with AT Protocol PDS.
  • Handles OTP-based sign-in, optional handle/DID-based identity resolution, and integration with the ePDS auth service for passwordless authentication.
  • Includes security patterns for DPoP nonce retries, PKCE, and secure session handling to support production-grade login flows.

Quick Start

Install and wire the epds-login skill in your app to enable passwordless AT Protocol login against your ePDS instance using the two supported flows.

Frequently Asked Questions about epds-login

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement passwordless login for an AT Protocol app using OAuth?▼

Passwordless AT Protocol login is enabled through OAuth with PAR and DPoP flows, handling PKCE, DPoP nonce retries, and token exchanges to provision user identities without passwords across Flow 1 and Flow 2.

What is the difference between Flow 1 and Flow 2 for AT Protocol OAuth authentication?▼

Flow 1 uses hand-rolled PAR and DPoP with an email login_hint for OTP-based sign-in, while Flow 2 uses the NodeOAuthClient to automate PAR/DPoP and handle inputs like no identifier, a handle, or a DID.

Can I use an email OTP or handle to authenticate users against an ePDS instance?▼

Yes, OTP-based sign-in is supported via Flow 1 using an email login_hint, and Flow 2 supports optional handle or DID-based identity resolution integrated with the ePDS auth service.

How do I configure client metadata for AT Protocol OAuth with PKCE and DPoP?▼

Client metadata configuration is required for flow selection, with reference implementation guidance available in the ePDS repository demonstrating integration with the AT Protocol PDS using NodeOAuthClient or hand-rolled approaches.

What security patterns are needed for production-grade OAuth token exchanges in AT Protocol apps?▼

Production-grade login flows require security patterns for DPoP nonce retries, PKCE, and secure session handling to support passwordless authentication and safe token exchanges.

Related Skills

Explore More Software Engineering Skills→
DuendeSoftwareDuendeSoftware
10

identityserver-token-security

Configures IdentityServer for DPoP, mTLS, PAR, JAR, and FAPI 2.0 token binding.

Official
Advanced
gnestorgnestor

gorgias

Converts natural language into authenticated calls to the Giraffas API for reading/writing data.

Community
Advanced
modu-aimodu-ai
67

moai-security

Configure Auth0 attack protection, MFA, token security, and compliance.

Official
Advanced
EverettFieldEverettField
2

auth-web-cloudbase

Implement CloudBase Web authentication flows with @cloudbase/js-sdk.

Community
Advanced