Working OAuth example?

[marckohlbrugge]

For the last week I've tried to implement ATProto OAuth with Ruby, but it's proven to be very complicated. Although there are numerous existing OAuth libraries, none implement the more modern (?) feature set that AT Proto requires, such as DPoP.

Finally haven given up on implementing it in Ruby, I decided to try Node instead as there's some official documentation and libraries available. Unfortunately, I've not succeeded to implement OAuth here either.

Although there are quite a few code examples available, none seem complete.

For example, there this:

https://www.npmjs.com/package/@atproto/oauth-client-node

Here's some of the issues with it I've found so far:

• It uses 'https://my-app.com/callback' as an example, but the Express route is /atproto-oauth-callback
• There is no explanation on how to generate a working private key (I finally was able to do this after much trial and error)
• It uses new Agent(session) yet Agent is not defined
• When trying to import Agent, there's a message saying it's not a constructor
• stateStore and sessionStore are not implemented (perhaps easy for experienced Node developers, but for someone with a different background like me this is yet another hurdle to overcome)
• requestLock is not explained

There's probably more issues, but I got stuck with the Agent not being authorized for some reason.

AT Proto looks promising, but without complete code examples it's very difficult for developers to integrate with it.

I'd like to propose for someone to create a complete (yet basic) code example of @atproto/oauth-client-node that works and is up-to-date.

[sh-k-l]

Here's a working example I found: https://github.com/pilcrowonpaper/atproto-oauth-example/tree/main

[apsquared]

Would this approach allow a user to login with bluesky and then allow my app to post on that user's behalf?

[jay-elizaga-dev]

Be careful copying the private key contents that the readme shows publicly: https://github.com/pilcrowonpaper/atproto-oauth-example/tree/main?tab=readme-ov-file#deploying-to-production

Please do NOT publicly release private keys.

[majkelcc]

Hi @marckohlbrugge, did you manage to make your code work somehow?

[brenc]

I'd love to see a complete working example using Typescript too (Bun, Node, Deno) for a bot account. Having a hard time figuring out how to switch to OAuth session management as the docs recommend doing.

[kidGodzilla]

I put together a node/express vanilla js example, if it's helpful to anyone who finds this in the future.

My last Todo (I think) is JWKS:

https://github.com/kidGodzilla/bsky-oauth-example

@apsquared you might need token storage and refresh as well if you want posts to happen while the user is not signed into your app. I've verified the node library handles token storage and refresh as long as you persist your session store or it survives the refresh cycle.

Edit: I also added a PR for what I learned during implementation that I wished was in the README.md:

#3254

[bnewbold]

I recommend looking at this OAuth announcement blog post: https://docs.bsky.app/blog/oauth-atproto

It links out to several resources, including an "OAuth Client Implementation Guide", and working client code in Python (which uses very few dependencies).