bryan newbold: hopefully nobody will be using OAuth in any real capacity with any PDS until we do an additional release with code updates as well as documentation! it is very experimental right now, as in for the dev team to be able to test if it works at all. we're only mentioning it b/c folks will splunk and see

PDS self-hosters! we have a distro release coming soon. the first part is schema support for starter packs, a feature we just released that uses records in the PDS. second is early OAuth backend support. we don't have the atproto OAuth system documented/specified, but will be soon

everything should just keep working w/o OAuth for the near future, just a heads up that it is coming. this distro release will include a database migration, so it won't be possible to trivially roll-back.

Will app password be deprecated one oauth released?

we will definitely recommend folks switching over to OAuth once it is ready, but don't want to remove critical features without a very generous notification/migration period. we'll probably also need to add some simple API token system for developers, which could look similar to app passwords

folks probably have many questions about OAuth; we'll try to address most of those in documentation in the near future

my main question would be what doesn't work

i'm guessing scopes for the bluesky app, better ui, etc are todo, but @dholms.xyz' announcement said "additional config is required to enable it on your PDS" but this doesn't appear to be the case..?

I think you'll need to configure a secret DPOP key for the PDS; otherwise all app config will fail after restarting the PDS process

huhh scary, why does the pds need a dpop key? and, is this only meant to happen if you do use oauth, or would it happen to everyone with the update?

hopefully nobody will be using OAuth in any real capacity with any PDS until we do an additional release with code updates as well as documentation! it is very experimental right now, as in for the dev team to be able to test if it works at all. we're only mentioning it b/c folks will splunk and see

Just try and stop me 😈

lol same bsky.app/profile/getd...

hello from oauth (dpop token!)

hmm still not sure what you meant by "all app config will fail", i can confirm that dpop tokens still work after restarting the pds

I might be confused!

lool it really does feel like everything works, but then things such as being able to revoke these without going in sqlite probably need to happen before apps adopt it

Post