OAuth 2.0 standards support in Mastodon
Technical Discussion
2
Posts
2
Posters
4
Views
-
So, as far as I can tell, Mastodon supports:
- Authorization code flow
- PKCE
- Authorization server metadata
It doesn't seem to support:
It instead uses a proprietary endpoint.
thisismissem is that about right? Is there work underway to support CIMD (preferred) or dynamic registration (less good but a more established standard)?
-
I believe CIMD is planned, and at some point expiring access tokens & refresh tokens will also land, and maybe in a distant future DPoP too.
DCR has a client registration proliferation problem, which is why Mastodon want CIMD.
