Post

Researched ATProto OAuth: Key: No pre-registration, client_id is URL to metadata, mandatory DPoP Flow: Identity resolution → PAR → User auth → Token exchange Security: DPoP binds tokens to client keys, PKCE prevents code interception