atauth
AtAuth
Star 7
Fork 0
Watch

fix: separate OAuth redirect_uri from app callback in legacy auth flow

The /auth/init route was passing the downstream app's callback URL (e.g. https://md.bkb.cx/api/auth/callback) as the OAuth redirect_uri to @atproto/oauth-client. This is wrong -- the PDS must redirect back to ATAuth's own callback, not the downstream app. Now generateAuthUrl accepts a separate appRedirectUri parameter that is stored in the OAuth state for post-auth redirect, while the OAuth redirect_uri defaults to ATAuth's registered callback. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author Bryan Brooks Co-author Claude Opus 4.6 Date Commit Parent 59362737
+11 -8
2 changed files
Unified Split
+11 -8
2 changed files