Mastodon 4.3 adds PKCE, the profile scope and OAuth server metadata, and removes the crypto scope

Announced8 Oct 2024

Effective8 Oct 2024

StatusIn effect

What changed

Mastodon 4.3.0 was released on October 8, 2024. Its changelog adds PKCE support in the OAuth flow, a profile OAuth scope for more limited access to user data, multiple redirect_uris when creating OAuth applications, RFC 8414 OAuth 2.0 server metadata, CORS on POST /oauth/revoke and api_versions in /api/v2/instance. It removes the unused E2EE messaging code and the related crypto scope, and adds grouped notifications (api/v2), notification policies and an unread notification count API.

What it means

Apps that connect to Mastodon can use PKCE, ask for the narrower profile scope, register several redirect URIs and discover OAuth settings automatically. The crypto scope is gone.

Who is affected

Developers of Mastodon clients and scheduling tools that connect accounts through OAuth, on servers running 4.3 or later.

What to do by 8 Oct 2024

Use PKCE (S256) in the authorization code flow, request profile instead of read:accounts when you only need the user's identity, read /.well-known/oauth-authorization-server and api_versions to detect features, and drop the crypto scope from app registrations.

What this means for you

When you connect a scheduling app to Mastodon, the app asks your server for permission. Mastodon 4.3 made that step safer and let apps ask for less: an app can now ask only to know who you are, instead of reading your whole account. Your server must run version 4.3 or newer for this to work.

The details

PKCE: GET /oauth/authorize accepts code_challenge and code_challenge_method (only S256); POST /oauth/token accepts code_verifier. Documented as added in 4.3.0.
profile scope: "allowing more limited access to user data". GET /api/v1/accounts/verify_credentials accepts a token with profile or read:accounts.
App registration: POST /api/v1/apps accepts multiple redirect_uris.
Discovery: RFC 8414 server metadata at /.well-known/oauth-authorization-server, and api_versions in /api/v2/instance "to make it easier for clients to detect compatible features going forward".
Other OAuth changes: CORS support on POST /oauth/revoke; token introspection without the read scope on /api/v1/apps/verify_credentials; the authorization prompt no longer calls apps "third-party".
Removed: E2EE messaging code and the crypto OAuth scope.
New API endpoints: grouped notifications under /api/v2/notifications (the changelog says this API "is not final yet"), notification policies and requests, GET /api/v1/notifications/unread_count, and GET /api/v1/accounts and GET /api/v1/statuses for fetching several at once.

What to do next

Business owners: Nothing. Reconnect an account only if your tool asks you to.
Marketers and agencies: Nothing, unless a tool fails to connect a client's Mastodon account: check that the server runs 4.3 or newer.
Developers: Add PKCE, request profile where it is enough, stop asking for crypto, and gate features on api_versions.

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.