AT Protocol OAuth adds email scope, plans longer sessions, fixes client bugs

What changed

On June 12, 2025 the AT Protocol team added a transition:email scope and announced planned lifetime increases: public client sessions from 1 week to 2 weeks, confidential client refresh tokens from 1 month to 3 months and overall sessions from 1 year to 2 years. Several bug fixes landed in the TypeScript client and reference server. Granular auth scopes were described as nearly designed but not yet implemented on the server.

What it means

OAuth clients get a transition:email scope, longer planned sessions, and must update libraries and DPoP handling.

Who is affected

Developers of apps and schedulers that sign users in to Bluesky with AT Protocol OAuth.

What to do

Update @atproto/oauth-client to 0.3.18 or later, remove the iss field from DPoP JWTs sent to the PDS, and keep the same attestation key for a session's lifetime. The post gives no deadlines.