oauth

oauth

more detailed notes on AT Protocol OAuth beyond the broad overview in ../auth.md.

contents scopes - choosing scopes, permission sets, progressive scope upgrades, and when transition:generic is the wrong tool dpop - server-side DPoP: stateless nonces, the use_dpop_nonce dance, proof verification field by field