Serve atproto OAuth client metadata at /oauth-client-metadata.json by default, configurable (v0.6.0) - #112
Merged
Conversation
… default, configurable (v0.6.0) The reference PDS consent screen shows just the hostname for a client_id at the conventional root path and the full URL for any other path. Serve the document at the root by default and use it as client_id. - useRootOAuthClientMetadata (default true); false keeps it under USERS_PATH - customOAuthClientMetadataURL for a self-hosted document (requires the flag off); StartupAPI keeps a reference copy under USERS_PATH to mirror - handleProviderExtraRoutes runs before USERS_PATH routing so a provider can claim a root path - README section on the three modes, consent-screen behavior and PDS_OAUTH_TRUSTED_CLIENTS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
startup-api | 677e465 | Aug 22 2026, 07:01 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The atproto OAuth spec allows the client-metadata document at any
https://URL, but/oauth-client-metadata.jsonat the domain root is the recognized convention. The reference PDS consent UI (isConventionalOAuthClientId,ClientName) shows just the hostname for aclient_idat that exact path and the full URL with path for anything else — so users of apps on StartupAPI sawhttps://host/users/auth/atproto/client-metadata.jsonon the Bluesky consent screen.(
client_name/logo_uriare only ever shown for clients the PDS operator allowlists viaPDS_OAUTH_TRUSTED_CLIENTS; no path changes that. Documented.)What
/oauth-client-metadata.jsonand used asclient_id— the only route StartupAPI claims outsideUSERS_PATH.useRootOAuthClientMetadata(defaulttrue);falsekeeps the document andclient_idunderUSERS_PATHas before.customOAuthClientMetadataURL— a self-hosted document (root-relative path or absolutehttps://URL) becomesclient_id; StartupAPI does not claim the root path and keeps a reference copy underUSERS_PATHto mirror. RequiresuseRootOAuthClientMetadata: false(config error otherwise).handleProviderExtraRoutesextracted fromhandleAuthand run before theUSERS_PATHrouting increateStartupAPI.client_id, and both config errors. README section with a mode table and the consent-screen / trusted-client caveats.The default
client_idchanges, which invalidates existing atproto authorizations — users just log in again. SetuseRootOAuthClientMetadata: falseto keep the previousclient_id.🤖 Generated with Claude Code