Tag: oauth

OAuth for MCP Servers with Cognito and Okta

When I added OAuth to the MixCraft MCP server, the identity provider was Clerk, and Clerk did the whole job: it was the OAuth authorization server the MCP client talked to, it signed in the user, and it issued the tokens the MCP server verified. The next remote MCP server I put behind a login had users who already sign in through Okta, so Okta had to be where the sign-in happened. Okta is the identity provider here, but most of the configuration is on the Cognito side: a Cognito user pool federa

MetalBear hardens OAuth, session scopes, and identity against the reference PDS

An unauthenticated login_hint could mint an OAuth code for any account, app passwords and full-access OAuth grants could reach account-deletion and email-change endpoints, and DPoP was optional everywhere it mattered -- all closed, alongside a run of PLC identity bugs and a new WebAuthn/passkey login path. 0.7.0 to 0.38.2.

atgc: atproto git client

yet another fucking tangled CLI project

Latch - an Elixir atproto OAuth library

Introducing Latch, an idiomatic elixir atproto OAuth library and client, built for flexibility and correctness.

inkwell-website

Landing page and OAuth metadata host for the Inkwell iOS app.

AT Protocol MCP Server: Identity & RichText Milestone

AT Protocol MCP Server: Identity & RichText Milestone

The Atmosphere needs a front door

The Atmosphere needs a distinct brand identify, better tools for builders, a new UX for users, and a small empowered group willing to build it all.

Adding OAuth to an MCP Server: From API Keys to Browser Login

MixCraft started with static API keys—generate one from the web portal, paste it into your Claude Code config. The mx_ prefixed keys had no expiration, lived in shell history and dotfiles, and revoking one meant generating a new key and updating every client. Service tokens from third-party APIs expired after an hour with no refresh mechanism, so users would get silent failures mid-session. I needed to replace the whole auth model with OAuth. But worse, it didn't work well with claude.ai because

Working to Decentralize FedCM

Bluesky Social PBC have given a grant to Emelia Smith, an Invited Expert with the FedID Working Group, to work on FedCM with the goal of making FedCM really work for the decentralized web.

Authenticated XRPC Calls in Lexicon Garden

ATProtocol OAuth pairs effortlessly with Lexicon Garden to make it easy for developers to experiment with authenticated XRPC endpoints.

A Thought on PDS Administration

PDS_ADMIN_PASSWORD needs a lift

I really don't want to be you

Server side session management while avoiding storing any user authentication token on the server itself.

Easy OAuth with IO

Implementing OAuth can be a hassle. IO did it for you.

アップデート情報 (2025/5/11)

Bluecast のアップデート情報です: あたらしい OAuth 認証に関して改善をつづけています。また、パフォーマンスの改善もおこなっています。 配信開始時に Bluesky にポストされる画像の変更をおこないました

アップデート情報 (2025/5/8)

Bluecast のアップデート情報です: あたらしい OAuth 認証に関して、サインインできないといった問題が起こっていたので、対応しました。また、パフォーマンスも若干改善しました。 UI に関しては、ミュート時のミ

アップデート情報 (2025/5/6)

Bluecast のアップデート情報です: あたらしい OAuth 認証の処理に関していくつか問題があったので、修正しました。ページ遷移時などのパフォーマンスも若干改善しているのではないかと思います。 配信にはいった際に

アップデート情報 (2025/5/3)

Bluecast のアップデート情報です: これまで OAuth 認証の処理に若干の問題があったため、これを改善しました。内部的には大きなアップデートですが、ユーザーのみなさんにはこれまで通り違和感なくご利用いただけるは

Build AT Protocol OAuth Support

Build support for AT Protocol Authorization directly into IO.

Build OAuth Support

Build support for OAuth into IO.

WordPress.com Connect

Automattic kündigt WordPress.com Connect an... und damit wieder einer der OpenID Connect ignoriert und statt dessen auf OAuth 2 setzt.

HTTP signatures

It looks like I'm not the only person who likes the idea of signed HTTP requests as an authentication method. Joyent and Digital Bazaar have co-written an Internet draft for cryptographically signed HTTP requests: Several web service providers have invented their own schemes for signing HTTP requests, but to date, none have been placed in the public domain as a standard. This document serves that purpose. There are no techniques in this proposal that are novel beyond previous art, however, thi

404: specification not found

(Kleiner Nachtrag zu der "OAuth ist tot" Kolumne in der SCREENGUIDE Ausgabe 15 um zu zeigen, warum gerade das W3C auch für Community Formate durchaus nützlich sein kann) Vor ein paar Wochen kam eine E-Mail mit der Bitte, an einer Umfrage zu den W3C Community and Business Groups teilzunehmen und das hat mich daran erinnert,...

SCREENGUIDE – Oh my god they killed OAuth

(das Bild hab ich mir von hueniverse.com ausgeliehen) Am Freitag (also morgen) gibt's mal wieder 'ne neue SCREENGUIDE mit dem Fokus auf "Social Commerce"... In meiner Kolumne geht es diesmal um OAuth und das Dilemma dass offene Standards, wenn sie einmal vom W3C oder der IETF betreut werden, zu wahren Monstern mutieren. Open Web Technologien...

Facebook OAuth with Scribe and Gson in Struts 1

Decentralized social networking using web intents

I believe that web intents are the last missing piece for decentralized social networking. (Previously I've talked about creating a social web architecture using Activity Streams and OAuth; this builds on that idea.) Picture this chain of events: 1. I visit your website, and see that you have a "connect to me" button[1]. 2. I click the button, launching the "social-connect" web intent. 3. If I have web intents, my browser "logs me in" to your website via OpenID, silently passing the URL of

OpenWeb-Notizen: OStatus, Facebook, pubsubhubbub

How to implement OStatus? Evan Prodromou (der Gründer von StatusNet) hat eine Schritt-für-Schritt-Anleitung veröffentlicht, wie man die eigene Seite verOStatust! Making your application a full-fledged participant in the federated social web is not easy, but gradual and incremental improvements can make your users' activities visible to others. » How to OStatus-enable Your Application Is your...

OpenWeb-Notizen: XAuth, OExchange, Firefox Sync, RDFa

Chris Messina erklärt XAuth XAuth ist eine Art Cross-Domain Cookie mit dem man Versucht die Flut an Share, Like und Login Icons auf ein Minimum zu reduzieren. http://vimeo.com/12121710 » XAuth - an introduction » Offizielle XAuth Seite OExchange einfach erklärt OExchange ist ein offenes Protokoll um eine beliebige URL mit einem beliebigen Service im Web...

Direct messaging in a social web architecture

This post is the third segment in my series on an architecture for the social web. Previously: How social networks can replace email, which is a non-technical approach to the issues, and my follow-up describing how to build a social web architecture using available technology today. So what about direct messaging? In my previous post, I described content notifications in the social web as being Activity Streams updates in response to requests signed with an OAuth key. Each individual contact w

Activity Streams and OAuth: a social web architecture

My previous post was a response to Gartner’s prediction last month that social networking would replace email as the “primary vehicle for interpersonal communications for 20 percent of business users.” In it, I named some properties that would need to be held by any social networking system that would successfully replace email. * Ease of use * Ubiquity across devices * Platform, service and infrastructure independence My argument boiled down to the following statement: Email has succeeded

The Open Stack and truly open APIs

The following is an expanded version of the short talk I gave in Oxford yesterday. My original slides follow the transcript. There’s a new kind of web development afoot, which marries old-school object-orientated programming techniques with the distributed power of the web. Application Programming Interfaces (APIs) are published sets of instructions for programmatically querying or extending a service. For example, the Google Maps API allows anyone with some development skills to build applica

Implementing open standards is too hard

[..] the plain truth is this: it's empirically way too painful still for first-time OAuth developers to get their code working, and despite the fact that OAuth is a standard, the empirical "it-just-works-rate" is way too low. Joseph Smarr: Implementing OAuth is still too hard... but it doesn't have to be. This isn't just true of OAuth; try writing an OpenID client or server from scratch. The same probably holds for every part of the open stack. Open doesn't just mean that anybody can use a for

Open Web Podcast: Privacy, Password Anti Pattern, Delegated Authorization

So, die erste Folge im neuen Jahr hat ein wenig gedauert (dafür war die Weihnachts-Folge ja etwas länger ;) ) aber jetzt ist sie fertig. Thema ist diesmal Privacy im Internet... Christian berichtet ein wenig vom vom 25. Chaos Communication Congress und ich gehe etwas näher auf das Thema Password Anti Pattern, Phishing und Delegated...

Portable Contacts (schicker als ich dachte)

In der aktuellen Folge (Episode 5: The Portable Contacts Initiative) sprechen John McCrea, Joseph Smarr und Chris Messina über das Portable Contacts - Projekt über welches ich vor kurzem noch so gescholten habe... Und ich muss sagen, ich hatte unrecht! Ich glaube kleine Gruppen mit dem Fokus auf ein spezielles Problem können wesentlich effektiver arbeiten...

WordPress 2.7 mit OAuth support?

In den Proposed New Features wird es zumindest aufgeführt... (via)

dataportability.org

Standardized Data Portability is the next great frontier for the web. As users, our identity, photos, videos and other forms of personal data should be discoverable by, and shared between our chosen tools or vendors. We need a DHCP for Identity. A distributed File System for data. This page will list the standards and contributors...