atproto-oauth

OAuth 2.1 client for the AT Protocol: pushed authorization requests, PKCE, DPoP with nonce rotation, token refresh and revocation, and scope parsing. It works with any account on any PDS, and re-verifies the DID → PDS → authorization server chain after every token exchange.

It builds on the atproto SDK for identity resolution. The same code is proposed for the SDK itself in MarshalX/atproto#636; this package exists so projects can depend on it from PyPI until the SDK ships OAuth.

uv add atproto-oauth

from atproto_oauth import OAuthClient
from atproto_oauth.stores import MemorySessionStore, MemoryStateStore

client = OAuthClient(
    client_id="https://app.example.com/oauth-client-metadata.json",
    redirect_uri="https://app.example.com/oauth/callback",
    scope="atproto",
    state_store=MemoryStateStore(),
    session_store=MemorySessionStore(),
)

# send the user to auth_url; your callback receives code, state and iss
auth_url, state = await client.start_authorization("alice.example.com")
session = await client.handle_callback(code=code, state=state, iss=iss)

response = await client.make_authenticated_request(
    session=session,
    method="GET",
    url=f"{session.pds_url}/xrpc/com.atproto.repo.describeRepo?repo={session.did}",
)

For local development, a client ID of http://localhost makes it a loopback client with no hosted metadata; use http://127.0.0.1 in the redirect URI.

Set ATPROTO_USER_AGENT to replace httpx's default User-Agent for the whole process.