A proxied XRPC call's service-auth token now carries the service's bare DID as aud, such as did:web:api.bsky.app, not the atproto-proxy reference did:web:api.bsky.app#bsky_appview. That matches the reference PDS. Bluesky's AppView compares aud exactly against its own DID and a configured list of alternates, so the fragment form risked every proxied Bluesky call being refused. The OAuth rpc: scope check still uses the full did#service reference.
com.atproto.server.getServiceAuth is unchanged, because its caller names its own audience. The proxy tests now expect the bare DID and check that a narrower scope still refuses. The conformance notes describe both forms. This closes the inbox epic's open item about the proxy's audience.
🤖 Generated with Claude Code