atproto_oauth

OAuth 2.0 with DPoP for the AT Protocol

A Dart implementation of the AT Protocol OAuth profile: pushed authorisation requests, PKCE, DPoP-bound tokens and automatic refresh, with every stage of the flow pluggable.

ActivePersonalOpen source

Record

Kind
Package
Role
Author
Started
November 2023
Updated
August 2026
Licence
BSD-3-Clause
pub
atproto_oauth · atprotodart.com

Technology7

Evidence6 sources

OAuthClient documents the checks it enforces as PKCE (RFC 7636), PAR (RFC 9126), DPoP (RFC 9449), RFC 9207 iss validation and RFC 8414 issuer discoverysourcegithub.com The authorisation request generates a code verifier and sends code_challenge_method S256 to the pushed authorisation request endpointsourcegithub.com The README documents the Flutter flow with flutter_web_auth_2, and hands the resulting session to the bluesky client through OAuthSessionManagerdocsgithub.com The atproto_core pubspec.yaml declares atproto_oauth among its dependenciessourcegithub.com The CHANGELOG records v0.7.0 and v0.7.1 as SSRF fixes on the authorisation server host and on redirect followingdocsgithub.com pub.dev lists five supported platforms — Android, iOS, Linux, macOS and Windowspackagepub.dev

Links3

Package pub.dev Repo github.com Docs atprotodart.com

Relations3 edges

atproto.dartPart ofDart SDK monorepo for AT Protocol and Bluesky atproto_identityDepends onAT Protocol identity resolution for Dart atproto_coreUsed byShared core layer for the atproto.dart SDK