@pdsjs/oauth-client

Browser OAuth for public atproto clients. It implements authorization code with PKCE, pushed authorization requests, DPoP-bound tokens, refresh, revocation and session storage.

Create one client per application. Supply the application's identity resolver, requested scope and storage prefix. The prefix lets an application preserve its existing session keys when it moves to this package.

import { createDpopClient, createOAuthClient } from '@pdsjs/oauth-client';

const dpop = createDpopClient({ databaseName: 'my-app-oauth' });
const oauth = createOAuthClient({
  dpop,
  resolveIdentity,
  scope: 'atproto',
  storagePrefix: 'my-app',
});

await oauth.beginSignIn('alice.example');

The dpop export provides the same key and proof for credentials other than OAuth tokens. Its key stays non-extractable in IndexedDB.