atomo
ATOMO: what our apps call ATProto OAuth login. Client metadata for each app, and the Swift parts. アトモ：ATProto の共通認証（OAuth）の呼び名。アプリごとの client
Star
Fork
Watch
8 1 0
Files
docs
Atomo.swift
AtomoWindow.swift
bianco.json
blusco.json
index.html
kamikire.json
nirvana.json
re.json
README.ja.md
README.md
README.md

ATOMO #

ATOMO is what our apps call ATProto OAuth, the shared way to log in. The button reads “Log in with ATOMO”.

日本語

The name #

It follows the names of Japanese transit cards (Suica, ICOCA, PASMO): short, easy to read, and it fits “Log in with ___” the way those fit “Ride with ___”.

  • AT plus tomo, Japanese for friend: a friend from the Atmosphere that comes along to every app
  • In Italian and Spanish, atomo is an atom: one indivisible you, the same in every app

The mark #

An empty ring of light. Type your handle and your avatar appears inside it: the same you, in whichever app.

The blusco login screen. An empty ring of light at the top left, an empty handle field, and a Log in with ATOMO button with a small ring. After typing moja.blue in the handle field. The ring now holds the moja.blue avatar.

Press “Log in with ATOMO” and the ring starts to breathe while Bluesky’s authorization page opens in a browser. The app never sees your password. The ring stays still otherwise, so it is not confused with other lights, such as new notifications.

After pressing the button. The ring around the avatar glows brightly and the button reads Logging in….

This repository #

It hosts each app’s OAuth client metadata, served with Tangled sites.

App client_id Redirect
blusco https://moja.tngl.io/atomo/blusco.json io.tngl.moja:/callback
Re: https://moja.tngl.io/atomo/re.json io.tngl.moja:/callback
kamikire https://moja.tngl.io/atomo/kamikire.json io.tngl.moja:/callback
bianco https://moja.tngl.io/atomo/bianco.json io.tngl.moja:/callback
nirvana (iOS) https://moja.tngl.io/atomo/nirvana.json io.tngl.moja:/callback
  • Native public clients (token_endpoint_auth_method: none) using PKCE, PAR and DPoP
  • The redirect scheme is the client_id host reversed. Apps on the same host share it, but the authorization sheet (ASWebAuthenticationSession) catches its own redirect, so they do not collide
  • Renaming a file changes the client_id and breaks every existing session’s refresh. Don’t
  • Atomo.swift logs a Mac app in with ATOMO (Foundation and CryptoKit only). AtomoWindow.swift is the mark and the login window for AppKit apps. Re: and kamikire carry copies of both