Passing an aud parameter that includes a fragment (did:web:api.colibri.social#colibri_appview) to the getServiceAuth endpoint will cause said endpoint to reject the request with an "invalid DID" error:
Invalid query parameter: aud: invalid DID: did:web:api.colibri.social#colibri_appview
According to the spec, the aud should include this fragment:
[...] Should include an optional fragment name identifying the specific service type and endpoint. Use of bare DIDs (with no service type) is used by some legacy software, but deprecated. [...]
https://atproto.com/specs/xrpc#inter-service-authentication-jwt
The request works fine with the reference PDS.
Important to note here is that the
audin the JWT and theaudin the XRPC endpoint are not the same thing! The specification you linked there is for the inter-service JWT whereas the format restriction is from the lexicon for the XRPC endpoint.With that said this is an issue! Just rooted in something else. The larger thing that happened here is https://github.com/bluesky-social/proposals/tree/main/0013-service-auth-refs which we helped push towards https://github.com/bluesky-social/proposals/tree/main/0014-service-auth-revised. Due to those changes the
getServiceAuthlexicon received backwards incompatible changes against usual lexicon evolution rules. We're still implementing the old version hence we, correctly by the old version, reject anything that isnt a DID. Ill see about updating this today should be a quick fix!