The client-metadata.json and jwks.json endpoints must be publicly accessible by Bluesky's OAuth server. Added: - Access-Control-Allow-Origin: * header - Cache-Control header for reasonable caching Note: The exe.dev proxy must be set to public for OAuth to work: ssh exe.dev share set-public stdeditor Co-authored-by: Shelley <shelley@exe.dev>