@tokyo_0 Ah. Authorized Fetch requires instances to authenticate themselves to fetch posts through ActivityPub; it's irrelevant to browsers. If you want to test Authorized Fetch, the procedure is to craft a request to fetch a user's ActivityPub outbox with only the "Accept: application/activity+json" header.