Editing OAuth (section)

== Key Components ==

=== Client Registration ===
In the AT Protocol, client applications identify themselves using a '''<code>client_id</code>''' that is a fully-qualified HTTPS URL pointing to a public metadata document. This eliminates the need for a central registration authority:<syntaxhighlight lang="http">
https://app.example.com/client-metadata.json
</syntaxhighlight>This metadata document contains essential information about the client, including redirect URIs, requested scopes, application type (web or native), and public keys (for confidential clients).

=== Client Types ===
The protocol supports two types of clients:

* '''Confidential Clients''': Applications with a server component which can securely store secrets. These clients:
** Authenticate using cryptographic keys
** Can receive longer-lived tokens
** Are typically web services or applications with backend components
* '''Public Clients''': Applications that run entirely on user devices. These clients:
** Cannot securely store secrets
** Receive shorter-lived tokens
** Are typically mobile apps or browser-based applications

=== Server Discovery ===
When a user wants to authenticate with their AT Protocol account, the application must:

# Resolve the user's [[handle]] or [[Decentralized Identifier (DID)]] to find their PDS
# Discover whether the PDS handles authentication directly or delegates to an "entryway" service
# Fetch the OAuth server metadata from the appropriate endpoint

This discovery process is meant to ensure that applications can authenticate users regardless of which PDS hosts their account.

=== Authorization Scopes ===
Scopes define what permissions an application is requesting. The AT Protocol defines several standard scopes:

* <code>'''atproto'''</code>: Required for all AT Protocol OAuth sessions
* '''<code>transition:generic</code>''': Broad permissions, similar to [[App Passwords]]
* '''<code>transition:chat.bsky</code>''': Access to direct messaging features

Applications should request only the scopes they need to function.

=== Token Management ===
The AT Protocol uses two types of tokens:

* '''Access Tokens''': Short-lived tokens (typically 5-30 minutes) used to make API requests
* '''Refresh Tokens''': Longer-lived tokens used to obtain new access tokens withing requiring user re-authentication

All tokens are bound to the specific client application (<code>client_id</code>), a unique cryptographic key for the session (DPoP), and the user's account identity