Conversation

Hi #ActivityPub developers, @helge, @smallcircles, @dansup, @patak, @cheeaun

I'd appreciate help with understanding oauth2 for developing a custom server that might work with Mastodon apps like @elk & @phanpy.

I've read how Mastodon implements getting user tokens (https://docs-p.joinmastodon.org/client/authorized/) but don't understand its security, lifespan or refresh requirement.

Is it what it looks like? A perpetual token not stored as JWT? The app provides the same token indefinitely as bearer auth in requests?