feat: atproto oauth #273

zeucapua · 2026-01-29T03:33:49Z

Implements AT Protocol OAuth using @atproto/api and @atproto/oauth-client-node. The form allows users to login with a handle from the app, create an account through selfhosted.social, or go through Bluesky.

npmx-oauth.mp4

Notes:

requires NUXT_SESSION_PASSWORD env variable to encrypt cookies
login will fail on preview due to the redirect URIs not matching the generated preview URL

This reverts commit 1c04dd9.

vercel · 2026-01-29T03:33:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Jan 30, 2026 0:35am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Jan 30, 2026 0:35am
npmx-lunaria	Ignored	Preview	Jan 30, 2026 0:35am

app/components/AuthModal.vue

app/components/AuthButton.vue

server/api/auth/atproto.get.ts

43081j · 2026-01-29T10:06:02Z

just a couple of minor comments but looks good to me, pretty straightforward! nice work 🎉

server/api/auth/session.delete.ts

server/api/auth/atproto.get.ts

Feat/atproto oauth

jonathanyeong

🔥

jonathanyeong · 2026-01-30T04:25:16Z

server/api/auth/atproto.get.ts

+  })
+
+  const response = await fetch(
+    `${SLINGSHOT_ENDPOINT}/xrpc/com.bad-example.identity.resolveMiniDoc?identifier=${agent.did}`,


For my knowledge, why does the endpoint contain bad-example?

That's fig lol. XRPC's need a nsid to be complete and they used their domain for it

https://atproto.com/specs/xrpc#lexicon-http-endpoints

fatfingers23

LGTM! all the atproto stuff is atprotoing

Kai-ros · 2026-01-30T10:43:33Z

shared/utils/fetch-cache-config.ts

  'api.bitbucket.org', // Bitbucket API
  'codeberg.org', // Codeberg (Gitea-based)
  'gitee.com', // Gitee API
+  //microcosm endpoints for atproto data


NIT:

Suggested change

//microcosm endpoints for atproto data

// microcosm endpoints for atproto data

Kai-ros · 2026-01-30T10:44:13Z

server/utils/atproto/storage.ts

+export const OAUTH_SESSION_CACHE_STORAGE_BASE = 'oauth-atproto-session'
+
+export class OAuthSessionStore implements NodeSavedSessionStore {
+  //TODO not sure if we will support multi accounts, but if we do in the future will need to change this around


NIT:

Suggested change

//TODO not sure if we will support multi accounts, but if we do in the future will need to change this around

// TODO: not sure if we will support multi accounts, but if we do in the future will need to change this around

Kai-ros · 2026-01-30T10:53:01Z

server/utils/atproto/storage.ts

+    }
+    deleteCookie(this.event, this.cookieKey)
+  }
+}


Could we add a factory at the bottom to clean up the API a bit?

export const useOAuthStorage = (event: H3Event) => { return { states: new OAuthStateStore(event), sessions: new OAuthSessionStore(event), } }

That way when it gets invoked elsewhere, like you do above in server/api/auth/atproto.get.ts, it could be as simple as const storage = useOAuthStorage(event).

Kai-ros · 2026-01-30T10:58:58Z

server/api/auth/session.delete.ts

+  if (!process.env.NUXT_SESSION_PASSWORD) {
+    throw createError({
+      status: 500,
+      message: 'NUXT_SESSION_PASSWORD not set',


NIT: Extract to constants file

Suggested change

message: 'NUXT_SESSION_PASSWORD not set',

message: UNSET_NUXT_SESSION_PASSWORD,

Kai-ros · 2026-01-30T10:59:10Z

server/api/auth/session.get.ts

+  if (!process.env.NUXT_SESSION_PASSWORD) {
+    throw createError({
+      status: 500,
+      message: 'NUXT_SESSION_PASSWORD not set',


NIT: Extract to constants file

Suggested change

message: 'NUXT_SESSION_PASSWORD not set',

message: UNSET_NUXT_SESSION_PASSWORD,

Kai-ros · 2026-01-30T10:59:32Z

server/api/auth/atproto.get.ts

+  if (!process.env.NUXT_SESSION_PASSWORD) {
+    throw createError({
+      status: 500,
+      message: 'NUXT_SESSION_PASSWORD not set',


NIT: Extract to constants file

Suggested change

message: 'NUXT_SESSION_PASSWORD not set',

message: UNSET_NUXT_SESSION_PASSWORD,

Kai-ros · 2026-01-30T11:26:59Z

server/api/auth/atproto.get.ts

We should add validation here since we're stepping outside of the system, the query params and a third-party API. Casting these with as could hide potential runtime crashes if for whatever reason the PDS or Slingshot return unexpected shapes.

AuthRequestSchema or AuthQuerySchema - For the validate getQuery(event)

MiniDocSchema - For the fetch response from the Slingshot endpoint

Kai-ros · 2026-01-30T11:32:31Z

server/routes/oauth-client-metadata.json.get.ts

As I understand it, this will be exposed to the public via the ATProto network? Would be nice to validate the output with a schema here as well. Just to guard against breakage for the OAuth handshake with an invalid URL or missing field.

Kai-ros · 2026-01-30T11:36:23Z

server/api/auth/session.get.ts

If we add a validation schema here we get the benefit of not having to perform repeat manual checks for NUXT_SESSION_PASSWORD and having a SessionDataSchema parse the session.data ensures the FE gets a reliable shape. Bonus is we won't accidentally leak any internal session metadata added down the line.

danielroe · 2026-01-30T11:49:59Z

we can ignore the provenance warnings btw

Kai-ros

See my above comments on validation. Regardless, great work.

zeucapua added 3 commits January 26, 2026 05:59

implement atproto oauth

1c04dd9

Revert "implement atproto oauth"

560f04d

This reverts commit 1c04dd9.

working atproto auth w/o nuxt-auth-utils

6215eb3

vercel bot had a problem deploying to Preview – docs.npmx.dev January 29, 2026 03:33 Failure

vercel bot deployed to Preview – npmx.dev January 29, 2026 03:34 View deployment

Merge branch 'main' into feat/atproto-oauth

8955ae6

vercel bot had a problem deploying to Preview – npmx-lunaria January 29, 2026 03:36 Failure

vercel bot had a problem deploying to Preview – npmx.dev January 29, 2026 03:37 Failure

vercel bot deployed to Preview – docs.npmx.dev January 29, 2026 03:37 View deployment

working atproto oauth login and logout

477cebb

vercel bot deployed to Preview – npmx.dev January 29, 2026 03:48 View deployment

vercel bot deployed to Preview – docs.npmx.dev January 29, 2026 03:48 View deployment

update auth styles

50decf2

vercel bot deployed to Preview – npmx.dev January 29, 2026 04:18 View deployment

vercel bot deployed to Preview – docs.npmx.dev January 29, 2026 04:18 View deployment

43081j reviewed Jan 29, 2026

View reviewed changes

app/components/AuthModal.vue Show resolved Hide resolved

43081j reviewed Jan 29, 2026

View reviewed changes

app/components/AuthButton.vue Outdated Show resolved Hide resolved

43081j reviewed Jan 29, 2026

View reviewed changes

server/api/auth/atproto.get.ts Outdated Show resolved Hide resolved

43081j reviewed Jan 29, 2026

View reviewed changes

server/api/auth/atproto.get.ts Outdated Show resolved Hide resolved

jonathanyeong reviewed Jan 29, 2026

View reviewed changes

server/api/auth/session.delete.ts Outdated Show resolved Hide resolved

fatfingers23 reviewed Jan 29, 2026

View reviewed changes

server/api/auth/atproto.get.ts Show resolved Hide resolved

fatfingers23 and others added 5 commits January 29, 2026 11:51

moved to server side storage for oauth sessions

1a678ee

adds oauth to middleware

cea37b4

moved to a defineEventHandler

86fb98a

wip

a4cecc9

Merge pull request #1 from fatfingers23/feat/atproto-oauth

aa3bf51

Feat/atproto oauth

vercel bot had a problem deploying to Preview – npmx.dev January 29, 2026 20:50 Failure

vercel bot deployed to Preview – docs.npmx.dev January 29, 2026 20:50 View deployment

vercel bot deployed to Preview – docs.npmx.dev January 30, 2026 02:48 View deployment

update login copy

0aad561

vercel bot deployed to Preview – docs.npmx.dev January 30, 2026 03:27 View deployment

vercel bot deployed to Preview – npmx.dev January 30, 2026 03:27 View deployment

add env step on CONTRIBUTING

e267dff

zeucapua marked this pull request as ready for review January 30, 2026 03:39

zeucapua requested review from 43081j and fatfingers23 January 30, 2026 03:39

vercel bot deployed to Preview – npmx.dev January 30, 2026 03:39 View deployment

vercel bot deployed to Preview – docs.npmx.dev January 30, 2026 03:39 View deployment

jonathanyeong approved these changes Jan 30, 2026

View reviewed changes

fatfingers23 approved these changes Jan 30, 2026

View reviewed changes

Kai-ros reviewed Jan 30, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into feat/atproto-oauth

0ecce4e

vercel bot deployed to Preview – npmx.dev January 30, 2026 11:23 View deployment

danielroe added 2 commits January 30, 2026 11:25

chore: ignore exports

cb66960

chore: remove missing prop

a45e707

Kai-ros reviewed Jan 30, 2026

View reviewed changes

vercel bot deployed to Preview – npmx.dev January 30, 2026 11:27 View deployment

Kai-ros reviewed Jan 30, 2026

View reviewed changes

Kai-ros suggested changes Jan 30, 2026

View reviewed changes

fix: use runtimeConfig and auto-gen dev session password

9102628

vercel bot deployed to Preview – npmx.dev January 30, 2026 12:35 View deployment

	//microcosm endpoints for atproto data
	// microcosm endpoints for atproto data

	//TODO not sure if we will support multi accounts, but if we do in the future will need to change this around
	// TODO: not sure if we will support multi accounts, but if we do in the future will need to change this around

	message: 'NUXT_SESSION_PASSWORD not set',
	message: UNSET_NUXT_SESSION_PASSWORD,

feat: atproto oauth #273

Are you sure you want to change the base?

feat: atproto oauth #273

Conversation

zeucapua commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

43081j commented Jan 29, 2026

Uh oh!

Uh oh!

Uh oh!

jonathanyeong left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fatfingers23 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kai-ros Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danielroe commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kai-ros left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

zeucapua commented Jan 29, 2026 •

edited

Loading

vercel bot commented Jan 29, 2026 •

edited

Loading

Kai-ros Jan 30, 2026 •

edited

Loading

danielroe commented Jan 30, 2026 •

edited

Loading