Conversation

Notices

1. Embed this notice
   Evan Prodromou (evan@cosocial.ca)'s status on Tuesday, 05-Aug-2025 04:39:48 JST Evan Prodromou

   • Emelia 👸🏻
   • naturzukunft

   @thisismissem @julian @naturzukunft the point of discovery is to find the important endpoints and parameters for the flows. Many implementers who are concentrating on a single API skip discovery because the resource provider has already defined the specific flow. It is absolutely 100% OK to do OAuth without doing discovery and dynamic client registration.

   • Embed this notice
     Evan Prodromou (evan@cosocial.ca)'s status on Tuesday, 05-Aug-2025 09:33:25 JST Evan Prodromou

     in reply to

     • Emelia 👸🏻
     • bumblefudge
     • Ben Pate 🤘🏻
     • naturzukunft

     @by_caballero @benpate @thisismissem @julian @naturzukunft that's too hard. We have an API. It already works.

   • Embed this notice
     Ben Pate 🤘🏻 (benpate@mastodon.social)'s status on Tuesday, 05-Aug-2025 09:33:26 JST Ben Pate 🤘🏻

     in reply to

     • Emelia 👸🏻
     • naturzukunft

     I'm genuinely behind on this. I've skimmed Evan's FEP, but a lot of OAuth complexity is still opaque to me.

     It seems like the missing piece with using the C2S API would be *figuring out* what endpoints I can call to initiate an activity.

     Does FEP-d8c2 implement discovery in some way that I'm not seeing? Or, is this something *still to be defined* and I'm just jumping the gun, here?

     @evan @thisismissem @julian @naturzukunft

   • Embed this notice
     bumblefudge (by_caballero@mastodon.social)'s status on Tuesday, 05-Aug-2025 09:33:26 JST bumblefudge

     in reply to

     • Emelia 👸🏻
     • Ben Pate 🤘🏻
     • naturzukunft

     @benpate @evan @thisismissem @julian @naturzukunft SWICG c2s task force wen (or will the payments task force just naturally become the c2s tf over time)

   • Embed this notice
     bumblefudge (by_caballero@mastodon.social)'s status on Tuesday, 05-Aug-2025 09:33:26 JST bumblefudge

     in reply to

     • Emelia 👸🏻
     • Ben Pate 🤘🏻
     • naturzukunft

     @benpate @evan @thisismissem @julian @naturzukunft all joking aside I think c2s requires emelia and Aaron's rfc on the OAuth side, and some equally complex discovery mechanism based on alternate AuthZ (presumably something based on certificate-ized Object Capabilities?) if we wanna stay composable and not-100%-dependent on oauth...

   • Embed this notice
     Evan Prodromou (evan@cosocial.ca)'s status on Tuesday, 05-Aug-2025 11:29:21 JST Evan Prodromou

     in reply to

     • Emelia 👸🏻
     • Ben Pate 🤘🏻
     • naturzukunft

     @benpate @thisismissem @julian @naturzukunft I forgot to ask: have you ever implemented an OAuth client before? Or used a library for it?