Today's toy: atlogin, an OIDC provider for the AT network, compatible with Tailscale custom OIDC.
Try this: login.tailscale.com and login as user "@at.apenwarr.ca". You'll join my test tailnet (ACL isolated from other users).
Source: github.com/apenwarr/atlogin
Try this: login.tailscale.com and login as user "
Source: github.com/apenwarr/atlogin
GitHub - apenwarr/atlogin: An OIDC provider that logs in with ATProto
An OIDC provider that logs in with ATProto. Contribute to apenwarr/atlogin development by creating an account on GitHub.
github.com
January 12, 2026 at 8:21 PM
Today's toy: atlogin, an OIDC provider for the AT network, compatible with Tailscale custom OIDC.
Try this: login.tailscale.com and login as user "@at.apenwarr.ca". You'll join my test tailnet (ACL isolated from other users).
Source: github.com/apenwarr/atlogin
Try this: login.tailscale.com and login as user "
Source: github.com/apenwarr/atlogin
Dropping my big French government apps + atproto OIDC research project on a Friday so y'all can spend the weekend tinkering with it.
I've got apps installed that support Login with Atmosphere - fill out the form to help test them!
I've got apps installed that support Login with Atmosphere - fill out the form to help test them!
LaSuite Apps + Atmosphere Accounts
The French government LaSuite apps connected with Login with Atmosphere OIDC
blog.bmannconsulting.com
September 19, 2026 at 12:02 AM
Dropping my big French government apps + atproto OIDC research project on a Friday so y'all can spend the weekend tinkering with it.
I've got apps installed that support Login with Atmosphere - fill out the form to help test them!
I've got apps installed that support Login with Atmosphere - fill out the form to help test them!
I built a translator between Atproto's OAuth and OIDC, so apps like @tailscale.com can use your Bluesky identity. It includes a whitelist so you can invite people directly using their DID!
Decentralised Identity 🤝 Mesh Networking
How you can invite your Bluesky friends into your Tailscale network using an OIDC shim
thinking-with-portals.leaflet.pub
August 6, 2026 at 10:17 PM
I built a translator between Atproto's OAuth and OIDC, so apps like @tailscale.com can use your Bluesky identity. It includes a whitelist so you can invite people directly using their DID!
OIDC what OIDC is but thanks
May 21, 2026 at 4:13 PM
OIDC what OIDC is but thanks
I wonder if I've gained more time signing in using OIDC than I've lost debugging OIDC setups
September 24, 2026 at 11:28 AM
I wonder if I've gained more time signing in using OIDC than I've lost debugging OIDC setups
quilling.dev/ratlogin
An OIDC provider for AT Protocol OAuth. Rust port of apenwarr/atlogin.
tangled.org
September 10, 2026 at 3:16 PM
Cal.com went closed source and forked off Cal.diy as MIT.
So… I could just create my own OIDC plugin for it and connect it up to atmosphere accounts?
Calendaring is definitely the final boss.
So… I could just create my own OIDC plugin for it and connect it up to atmosphere accounts?
Calendaring is definitely the final boss.
GitHub - bmann/cal.diy: Scheduling infrastructure for absolutely everyone.
Scheduling infrastructure for absolutely everyone. - bmann/cal.diy
github.com
September 25, 2026 at 3:47 AM
New version of my ATProto/Bluesky OIDC provider. I've moved to a lovely new atlogin.net domain and it now contains a self-help form for setting up webfinger on your own domain so you can have your own domain for coworkers and/or friends to use in any app.
Source: github.com/apenwarr/atlogin
Source: github.com/apenwarr/atlogin
January 15, 2026 at 6:18 PM
New version of my ATProto/Bluesky OIDC provider. I've moved to a lovely new atlogin.net domain and it now contains a self-help form for setting up webfinger on your own domain so you can have your own domain for coworkers and/or friends to use in any app.
Source: github.com/apenwarr/atlogin
Source: github.com/apenwarr/atlogin
Want to integrate auth into your apps in #rstats? OIDC may be something you come across.
josiahparry.com/posts/2024-1...
josiahparry.com/posts/2024-1...
Josiah Parry - Implementing OpenID Connect (OIDC) in R
josiahparry.com
November 28, 2024 at 7:36 PM
Want to integrate auth into your apps in #rstats? OIDC may be something you come across.
josiahparry.com/posts/2024-1...
josiahparry.com/posts/2024-1...
I looked at all the AWS OIDC integrations I could find to identify how they might be misconfigured and to understand the variations that different vendors have in how they set these up. www.wiz.io/blog/avoidin...
Avoiding mistakes with AWS OIDC integration conditions | Wiz Blog
Secure AWS OIDC integrations by avoiding common misconfigurations. Discover key IAM trust policy conditions for popular SaaS vendors to protect your cloud.
www.wiz.io
January 1, 2025 at 3:21 PM
I looked at all the AWS OIDC integrations I could find to identify how they might be misconfigured and to understand the variations that different vendors have in how they set these up. www.wiz.io/blog/avoidin...
Another OIDC gateway approach for using your atproto account to login to many different things tangled.org/bkb.arcnode....
Nice work @bkb.arcnode.xyz!
Nice work @bkb.arcnode.xyz!
March 9, 2026 at 6:15 PM
Another OIDC gateway approach for using your atproto account to login to many different things tangled.org/bkb.arcnode....
Nice work @bkb.arcnode.xyz!
Nice work @bkb.arcnode.xyz!
Most self-hosted stacks still lean on identity providers built for enterprises.
Pocket ID is the lighter alternative: self-hostable, OIDC/OAuth 2.0 compatible, and passwordless. Sign in to any compatible app with a passkey, no password ever stored.
openalternative.co/pocket-id
Pocket ID is the lighter alternative: self-hostable, OIDC/OAuth 2.0 compatible, and passwordless. Sign in to any compatible app with a passkey, no password ever stored.
openalternative.co/pocket-id
Pocket ID: Open Source Alternative to Auth0 and Okta
Self-hostable OpenID Connect and OAuth 2.0 provider that lets users sign in to any OIDC-compatible app using passkeys instead of passwords.
openalternative.co
September 26, 2026 at 7:56 PM
Most self-hosted stacks still lean on identity providers built for enterprises.
Pocket ID is the lighter alternative: self-hostable, OIDC/OAuth 2.0 compatible, and passwordless. Sign in to any compatible app with a passkey, no password ever stored.
openalternative.co/pocket-id
Pocket ID is the lighter alternative: self-hostable, OIDC/OAuth 2.0 compatible, and passwordless. Sign in to any compatible app with a passkey, no password ever stored.
openalternative.co/pocket-id
I've outlined a proposal that allows for authenticated pipelines on @tangled.sh via OIDC
Would love to hear thoughts!
tangled.sh/@tangled.sh/...
Would love to hear thoughts!
tangled.sh/@tangled.sh/...
Proposal: Pipeline OIDC · issue #162 · @tangled.sh/core
Monorepo for Tangled — https://tangled.sh
tangled.sh
August 10, 2025 at 2:09 PM
I've outlined a proposal that allows for authenticated pipelines on @tangled.sh via OIDC
Would love to hear thoughts!
tangled.sh/@tangled.sh/...
Would love to hear thoughts!
tangled.sh/@tangled.sh/...
It's time for us to write a non-normative document on atproto + OIDC
AIP: OAuth 2.0/2.1 + OpenID Connect gateway for ATProtocol. Now you can use your existing tools, apps, and SDKs with your ATProtocol identity. One of the ATmosphere’s rough edges just got a lot smoother.
June 23, 2025 at 1:03 PM
It's time for us to write a non-normative document on atproto + OIDC
let me use my own oidc provider instead
May 20, 2026 at 7:20 PM
let me use my own oidc provider instead
this is a generic OIDC provider that uses your atproto identity to log in to basically… anything that supports OIDC or can be made to support it via an SSO provider like authentik/zitadel/etc
i cannot stress enough how useful this is and how good a job kira (and upstream!) did here
i cannot stress enough how useful this is and how good a job kira (and upstream!) did here
@astrra.space wanted atproto login for forgejo, so i went poking around atlogin. forked anirudh’s version, fixed several auth bugs, and added a handle login form. apps receive your did and handle
https://tangled.org/kira.ws/atlogin
https://tangled.org/kira.ws/atlogin
September 9, 2026 at 12:18 AM
this is a generic OIDC provider that uses your atproto identity to log in to basically… anything that supports OIDC or can be made to support it via an SSO provider like authentik/zitadel/etc
i cannot stress enough how useful this is and how good a job kira (and upstream!) did here
i cannot stress enough how useful this is and how good a job kira (and upstream!) did here
the atproto oauth profile is pretty special. both oidc and atproto deal with authentication, but the settings are quite different.
oidc: client trusts the auth server (AS), and you receive a user id relative to the AS.
atproto: client doesn't trust the AS, and you receive a global (!) user id.
oidc: client trusts the auth server (AS), and you receive a user id relative to the AS.
atproto: client doesn't trust the AS, and you receive a global (!) user id.
September 9, 2024 at 2:51 PM
the atproto oauth profile is pretty special. both oidc and atproto deal with authentication, but the settings are quite different.
oidc: client trusts the auth server (AS), and you receive a user id relative to the AS.
atproto: client doesn't trust the AS, and you receive a global (!) user id.
oidc: client trusts the auth server (AS), and you receive a user id relative to the AS.
atproto: client doesn't trust the AS, and you receive a global (!) user id.
one click oidc for rustical oh she loves me
March 12, 2026 at 7:11 PM
one click oidc for rustical oh she loves me
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
May 15, 2024 at 4:28 PM
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
after fighting with oauth and oidc today I’d just like to say that security was a mistake
May 14, 2024 at 3:55 AM
after fighting with oauth and oidc today I’d just like to say that security was a mistake
"When using OIDC, you configure IAM to accept JWTs from GitHub's OIDC endpoint."
listen bub I just wanna make sprite go blam
listen bub I just wanna make sprite go blam
April 10, 2025 at 10:17 AM
"When using OIDC, you configure IAM to accept JWTs from GitHub's OIDC endpoint."
listen bub I just wanna make sprite go blam
listen bub I just wanna make sprite go blam
‘Trusted Publishing’ is now available on NuGet.org! 🚀 Publish packages more securely with short lived OIDC tokens. No more key management! 🔒See the blog to get started: aka.ms/nuget/oidc-b... ✨ #NuGet #dotnet
September 22, 2025 at 4:13 PM
‘Trusted Publishing’ is now available on NuGet.org! 🚀 Publish packages more securely with short lived OIDC tokens. No more key management! 🔒See the blog to get started: aka.ms/nuget/oidc-b... ✨ #NuGet #dotnet