AT Protocol publishes its OAuth specification, replacing app passwords over time

What changed

On September 25, 2024 the AT Protocol team released the initial OAuth specification, in a developer preview phase that may still change. Clients must support automated discovery of the user's authorization server and automated client registration, so generic OAuth libraries may not work out of the box. Granular scopes are not yet defined and moving to them will likely require users to log out and back in.

What it means

OAuth becomes the intended way for apps to sign users in, so new integrations should stop relying on app passwords.

Who is affected

Developers of scheduling tools and clients that log in to Bluesky with app passwords, and the users who connect them.

What to do

Start building on OAuth now and avoid app passwords for new projects. Use transition:generic for app-password-equivalent access and add transition:chat.bsky for DMs. The post gives no date for ending app passwords.