diff --git a/app/api/oauth/[route]/oauth-metadata.ts b/app/api/oauth/[route]/oauth-metadata.ts
index e29dcb9b..6af54950 100644
--- a/app/api/oauth/[route]/oauth-metadata.ts
+++ b/app/api/oauth/[route]/oauth-metadata.ts
@@ -8,7 +8,7 @@ const hostname =
     : "https://leaflet.pub";
 
 const scope =
-  "atproto transition:generic transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts include:app.bsky.authViewAll blob:*/*";
+  "atproto transition:generic transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts include:app.bsky.authViewAll?aud=did:web:api.bsky.app%23bsky_appview blob:*/*";
 const localconfig: OAuthClientMetadataInput = {
   client_id: `http://localhost/?redirect_uri=${encodeURI(`http://127.0.0.1:3000/api/oauth/callback`)}&scope=${encodeURIComponent(scope)}`,
   client_name: `Leaflet`,
diff --git a/app/api/oauth/[route]/route.ts b/app/api/oauth/[route]/route.ts
index 38f8ebee..9c7eb139 100644
--- a/app/api/oauth/[route]/route.ts
+++ b/app/api/oauth/[route]/route.ts
@@ -43,7 +43,7 @@ export async function GET(
 
       const url = await client.authorize(handle || "https://bsky.social", {
         scope:
-          "atproto transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts include:app.bsky.authViewAll blob:*/*",
+          "atproto transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts include:app.bsky.authViewAll?aud=did:web:api.bsky.app%23bsky_appview blob:*/*",
         signal: ac.signal,
         state: JSON.stringify(state),
       });