C2S: OAuth endpoint discovery #3395

Open
opened 2026-01-15 17:23:04 +00:00 by mediaformat · 0 comments
Member

Pleroma has some decent support for the Client to Server API, but getting authorized can be a challenge.

Discovering the OAuth endpoints requires either implementing Authorization Server Metadata(rfc8414), or fetching the actor to discover the oauth endpoints listed there.

Fetching an Actor profile however, is currently blocked by CORS.

While implementors can guess that Pleroma uses similar api routes as Mastodon, this is not an ideal developer experience.

{
    oauthRegistrationEndpoint: instanceURL+'/api/v1/apps',
    oauthAuthorizationEndpoint: instanceURL+'/oauth/authorize',
    oauthTokenEndpoint: instanceURL+'/oauth/token',
}

For reference, the ActivityPub API Task Force is working on a standard OAuth Profile, see this diagram showing how to navigate the various options for getting a client id, authorization URL and token URL: https://github.com/swicg/activitypub-api/issues/1#issuecomment-3708524521

Pleroma has some decent support for the Client to Server API, but getting authorized can be a challenge. Discovering the OAuth endpoints requires either implementing **Authorization Server Metadata**([rfc8414](https://www.rfc-editor.org/rfc/rfc8414)), or fetching the actor to discover the oauth endpoints listed there. Fetching an Actor profile however, is currently **blocked by CORS**. While implementors can guess that Pleroma uses similar api routes as Mastodon, this is not an ideal developer experience. ```javascript { oauthRegistrationEndpoint: instanceURL+'/api/v1/apps', oauthAuthorizationEndpoint: instanceURL+'/oauth/authorize', oauthTokenEndpoint: instanceURL+'/oauth/token', } ``` For reference, the [ActivityPub API Task Force](https://github.com/swicg/activitypub-api/) is working on a standard OAuth Profile, see this diagram showing how to navigate the various options for getting a client id, authorization URL and token URL: https://github.com/swicg/activitypub-api/issues/1#issuecomment-3708524521
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#3395
No description provided.