oauth #

more detailed notes on AT Protocol OAuth beyond the broad overview in ../auth.md.

contents #

• clients - browser vs server client, public clients on workers, loopback dev, the session cookie, logout, callback failure taxonomy, handle typeahead
• scopes - choosing scopes, permission sets, progressive scope upgrades, and when transition:generic is the wrong tool
• dpop - server-side DPoP: stateless nonces, the use_dpop_nonce dance, proof verification field by field