Skip to content

Standard Reader

Tag

Oauth

Articles and publications tagged Oauth across the Atmosphere.

54articles28publications

Articles

Publications

poe's atmosphere dispatch

poe's atmosphere dispatchNov 9, 2026

would you pay for your algorithm?

on bluesky anyone can build the algorithm, and this week spacecowboy's indie for you feed started charging $5 a month for extras, alongside an election night storm, the first survey of atmosphere builders and a japanese art gallery made of bluesky posts.

atmospheredispatch

kozhevnikova

kozhevnikovaNov 6, 2026

AWX OAuth Scopes and RBAC Both Decide What Automation Can Do

Reviewing AWX OAuth token scopes, RBAC intersections, credential authority, and revocation.

andreagomez205

andreagomez205Nov 5, 2026

OpenProject API Tokens Need Project Membership Context

Reviewing OpenProject API tokens, OAuth and project-role permissions.

OpenProjectOAuth

eiuspkz

eiuspkzNov 3, 2026

Why PKCE must bind the authorization request, code, and verifier

Binding authorization codes and PKCE verifiers to one transaction without weakening downgrade checks.

kozhevnikova

kozhevnikovaNov 1, 2026

OAuth mTLS binds credentials to certificates, not to people

Design checks for mutual-TLS client authentication and certificate-bound OAuth tokens.

ivanova

ivanovaOct 31, 2026

Refresh Token Rotation Without Breaking Every Session

A practical design for refresh-token reuse detection, grant-family revocation and safe migration.

OAuthrefresh tokens

Boris Mann Tech Blog

Boris Mann Tech BlogOct 31, 2026

Riffing on Scott Jenson's Splitter

Scott Jenson built a single page thread splitting interface, and I overcomplicated it

atmospherethreading

andreagomez205

andreagomez205Oct 29, 2026

MCP tool authorization needs the request, token, and tool in one decision

Per-tool authorization and audience-bound token controls for MCP servers.

MCPauthorization

kozhevnikova

kozhevnikovaOct 22, 2026

2,900 sign-in attempts a minute: what the ConnectWise campaign teaches about third-party application trust

What the ConnectWise campaign reveals about OAuth consent, application credential persistence and detection at machine speed.

supply-chainconnectwise

Decentralizing FedCMOct 2, 2026

Update #1: Getting started and keeping momentum

subaud

subaudSep 30, 2026

Switching Claude accounts per session in pi

I use more than one Claude subscription. Most of the reason is usage: when one account runs low on its limits, I want to keep working on another. Claude Code normally has one login, so moving to another account means signing out and signing back in through the browser each time. /claude-account is a command in my fork of pi-claude-bridge, the pi extension that runs Claude models through Claude Code's Agent SDK. It keeps several Claude accounts signed in at once and lets each pi session choose

Thibault MeunierAug 27, 2026

Probing the MCP registry for anonymous access

A brief analysis of how MCP registry entries handle authentication

subaud

subaudAug 23, 2026

OAuth for MCP Servers with Cognito and Okta

When I added OAuth to the MixCraft MCP server, the identity provider was Clerk, and Clerk did the whole job: it was the OAuth authorization server the MCP client talked to, it signed in the user, and it issued the tokens the MCP server verified. The next remote MCP server I put behind a login had users who already sign in through Okta, so Okta had to be where the sign-in happened. Okta is the identity provider here, but most of the configuration is on the Cognito side: a Cognito user pool federa

ewan's devlogAug 12, 2026

MetalBear hardens OAuth, session scopes, and identity against the reference PDS

An unauthenticated login_hint could mint an OAuth code for any account, app passwords and full-access OAuth grants could reach account-deletion and email-change endpoints, and DPoP was optional everywhere it mattered -- all closed, alongside a run of PLC identity bugs and a new WebAuthn/passkey login path. 0.7.0 to 0.38.2.

metalbearatproto

permablog

permablogAug 6, 2026

atgc: atproto git client

yet another fucking tangled CLI project

jola.dev

jola.devAug 6, 2026

Latch - an Elixir atproto OAuth library

Introducing Latch, an idiomatic elixir atproto OAuth library and client, built for flexibility and correctness.

Ewan's Project DocumentationJun 30, 2026

inkwell-website

Landing page, legal pages and OAuth metadata host for the Inkwell apps — maintained in the inkwell monorepo's website/ directory.

sveltekitwebsite

G. Serrahima

G. SerrahimaJun 15, 2026

And specifically, ATProto's brand of OAuth

ewan's devlogJun 13, 2026

AT Protocol MCP Server: Identity & RichText Milestone

atprotoidentity

twinbfieldJun 2, 2026

How I've set up a password manager, and why you should too

studyWikipedia's compilation of most commonly used passwords

We Can Just Do Things

We Can Just Do ThingsMay 15, 2026

The Atmosphere needs a front door

The Atmosphere needs a distinct brand identify, better tools for builders, a new UX for users, and a small empowered group willing to build it all.

atmosphereuser experience

oh hey, it's owais

oh hey, it's owaisMay 5, 2026

Lazurite's Auth Implementation

Dev Log 51: 2026-05-05

subaud

subaudApr 3, 2026

Adding OAuth to an MCP Server: From API Keys to Browser Login

MixCraft started with static API keys—generate one from the web portal, paste it into your Claude Code config. The mx_ prefixed keys had no expiration, lived in shell history and dotfiles, and revoking one meant generating a new key and updating every client. Service tokens from third-party APIs expired after an hour with no refresh mechanism, so users would get silent failures mid-session. I needed to replace the whole auth model with OAuth. But worse, it didn't work well with claude.ai because

Decentralizing FedCMMar 6, 2026

Working to Decentralize FedCM

Bluesky Social PBC have given a grant to Emelia Smith, an Invited Expert with the FedID Working Group, to work on FedCM with the goal of making FedCM really work for the decentralized web.

fedcmdecentralized web