add loopback client metadata for oauth in local dev!!!!!

netlify/functions/batch-follow-users.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
-import { NodeOAuthClient } from '@atproto/oauth-client-node';
+import { NodeOAuthClient, atprotoLoopbackClientMetadata } from '@atproto/oauth-client-node';
 import { JoseKey } from '@atproto/jwk-jose';
 import { stateStore, sessionStore, userSessions } from './oauth-stores-db';
 import { getOAuthConfig } from './oauth-config';
···
       };
     }
 
-    // Initialize OAuth client
     const config = getOAuthConfig();
-    const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
-    const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+    const isDev = config.clientType === 'loopback';
 
-    const client = new NodeOAuthClient({
-      clientMetadata: {
-        client_id: config.clientId,
-        client_name: 'ATlast',
-        client_uri: config.clientId.replace('/client-metadata.json', ''),
-        redirect_uris: [config.redirectUri],
-        scope: 'atproto transition:generic',
-        grant_types: ['authorization_code', 'refresh_token'],
-        response_types: ['code'],
-        application_type: 'web',
-        token_endpoint_auth_method: 'private_key_jwt',
-        token_endpoint_auth_signing_alg: 'ES256',
-        dpop_bound_access_tokens: true,
-        jwks_uri: config.jwksUri,
-      },
-      keyset: [privateKey],
-      stateStore: stateStore as any,
-      sessionStore: sessionStore as any,
-    });
+    let client: NodeOAuthClient;
+
+    if (isDev) {
+      // Loopback
+      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+      client = new NodeOAuthClient({
+        clientMetadata: clientMetadata,
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    } else {
+      // Production with private key
+      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
+      const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+
+      client = new NodeOAuthClient({
+        clientMetadata: {
+          client_id: config.clientId,
+          client_name: 'ATlast',
+          client_uri: config.clientId.replace('/client-metadata.json', ''),
+          redirect_uris: [config.redirectUri],
+          scope: 'atproto transition:generic',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          token_endpoint_auth_method: 'private_key_jwt',
+          token_endpoint_auth_signing_alg: 'ES256',
+          dpop_bound_access_tokens: true,
+          jwks_uri: config.jwksUri,
+        },
+        keyset: [privateKey],
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    }
 
     // Restore OAuth session
     const oauthSession = await client.restore(userSession.did);

netlify/functions/batch-search-actors.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
-import { NodeOAuthClient } from '@atproto/oauth-client-node';
+import { NodeOAuthClient, atprotoLoopbackClientMetadata } from '@atproto/oauth-client-node';
 import { JoseKey } from '@atproto/jwk-jose';
 import { stateStore, sessionStore, userSessions } from './oauth-stores-db';
 import { getOAuthConfig } from './oauth-config';
···
       };
     }
 
-    // Initialize OAuth client
     const config = getOAuthConfig();
-    const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
-    const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+    const isDev = config.clientType === 'loopback';
 
-    const client = new NodeOAuthClient({
-      clientMetadata: {
-        client_id: config.clientId,
-        client_name: 'ATlast',
-        client_uri: config.clientId.replace('/client-metadata.json', ''),
-        redirect_uris: [config.redirectUri],
-        scope: 'atproto transition:generic',
-        grant_types: ['authorization_code', 'refresh_token'],
-        response_types: ['code'],
-        application_type: 'web',
-        token_endpoint_auth_method: 'private_key_jwt',
-        token_endpoint_auth_signing_alg: 'ES256',
-        dpop_bound_access_tokens: true,
-        jwks_uri: config.jwksUri,
-      },
-      keyset: [privateKey],
-      stateStore: stateStore as any,
-      sessionStore: sessionStore as any,
-    });
+    let client: NodeOAuthClient;
+
+    if (isDev) {
+      // Loopback
+      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+      client = new NodeOAuthClient({
+        clientMetadata: clientMetadata,
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    } else {
+      // Production with private key
+      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
+      const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+
+      client = new NodeOAuthClient({
+        clientMetadata: {
+          client_id: config.clientId,
+          client_name: 'ATlast',
+          client_uri: config.clientId.replace('/client-metadata.json', ''),
+          redirect_uris: [config.redirectUri],
+          scope: 'atproto transition:generic',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          token_endpoint_auth_method: 'private_key_jwt',
+          token_endpoint_auth_signing_alg: 'ES256',
+          dpop_bound_access_tokens: true,
+          jwks_uri: config.jwksUri,
+        },
+        keyset: [privateKey],
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    }
 
     // Restore OAuth session
     const oauthSession = await client.restore(userSession.did);

netlify/functions/client-metadata.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
 
 export const handler: Handler = async (event: HandlerEvent): Promise<HandlerResponse> => {
+
   try {
     // Get the host that's requesting the metadata
     // This will be different for production vs preview deploys vs dev --live
···
       };
     }
 
-    // Build the redirect URI based on the requesting host
+     // Check if this is a loopback/development request
+    const isLoopback = requestHost.startsWith('127.0.0.1') || 
+                       requestHost.startsWith('[::1]') ||
+                       requestHost === 'localhost';
+
+    if (isLoopback) {
+      // For loopback clients, return minimal metadata
+      // NOTE: In practice, the OAuth server won't fetch this because
+      // loopback clients use hardcoded metadata on the server side
+      const appUrl = `http://${requestHost}`;
+      const redirectUri = `${appUrl}/.netlify/functions/oauth-callback`;
+      
+      return {
+        statusCode: 200,
+        headers: {
+          'Content-Type': 'application/json',
+          'Access-Control-Allow-Origin': '*',
+        },
+        body: JSON.stringify({
+          client_id: appUrl, // Just the origin for loopback
+          client_name: 'ATlast (Local Dev)',
+          client_uri: appUrl,
+          redirect_uris: [redirectUri],
+          scope: 'atproto transition:generic',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          token_endpoint_auth_method: 'none', // No auth for loopback
+          dpop_bound_access_tokens: true,
+        }),
+      };
+    }
+
+    // Production: Confidential client metadata
     const redirectUri = `https://${requestHost}/.netlify/functions/oauth-callback`;
     const appUrl = `https://${requestHost}`;
     const jwksUri = `https://${requestHost}/.netlify/functions/jwks`;
     const clientId = `https://${requestHost}/.netlify/functions/client-metadata`;
-
-    console.log('Client metadata generated for host:', {
-      requestHost,
-      redirectUri,
-      appUrl,
-      clientId, 
-      jwksUri,
-    });
 
     const metadata = {
       client_id: clientId,
···
       headers: {
         'Content-Type': 'application/json',
         'Access-Control-Allow-Origin': '*',
-        'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-        'Pragma': 'no-cache',
-        'Expires': '0',
+        'Cache-Control': 'no-store'
       },
       body: JSON.stringify(metadata),
     };

netlify/functions/oauth-callback.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
-import { NodeOAuthClient } from '@atproto/oauth-client-node';
+import { NodeOAuthClient, atprotoLoopbackClientMetadata } from '@atproto/oauth-client-node';
 import { JoseKey } from '@atproto/jwk-jose';
 import { stateStore, sessionStore, userSessions } from './oauth-stores-db';
 import { getOAuthConfig } from './oauth-config';
···
 }
 
 export const handler: Handler = async (event: HandlerEvent): Promise<HandlerResponse> => {
-  let currentHost = process.env.DEPLOY_URL 
-    ? new URL(process.env.DEPLOY_URL).host
-    : (event.headers['x-forwarded-host'] || event.headers.host);
-  let currentUrl = currentHost ? `https://${currentHost}` : process.env.URL || process.env.DEPLOY_PRIME_URL || 'https://atlast.byarielm.fyi'; 
-  const fallbackUrl = currentUrl;
+  const config = getOAuthConfig();
+  const isDev = config.clientType === 'loopback';
+  
+  let currentUrl = isDev 
+    ? 'http://127.0.0.1:8888'
+    : (process.env.DEPLOY_URL 
+        ? `https://${new URL(process.env.DEPLOY_URL).host}`
+        : process.env.URL || process.env.DEPLOY_PRIME_URL || 'https://atlast.byarielm.fyi');
 
   try {
     const params = new URLSearchParams(event.rawUrl.split('?')[1] || '');
     const code = params.get('code');
     const state = params.get('state');
 
-    console.log('OAuth callback - Host:', currentHost);
-    console.log('OAuth callback - currentUrl resolved to:', currentUrl);
+    console.log('OAuth callback - Mode:', isDev ? 'loopback' : 'production');
+    console.log('OAuth callback - URL:', currentUrl);
 
     if (!code || !state) {
       return {
···
       };
     }
 
-    if (!process.env.OAUTH_PRIVATE_KEY) {
-      console.error('OAUTH_PRIVATE_KEY not set');
-      return {
-        statusCode: 302,
-        headers: {
-          'Location': `${currentUrl}/?error=Server configuration error`
-        },
-        body: ''
-      };
-    }
-
-    const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
-    const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
-    
-    // All URIs must now be based on the current deploy URL/host
-    const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
-    const jwksUri = `${currentUrl}/.netlify/functions/jwks`; // NOW DYNAMIC URL
-    const clientId = `${currentUrl}/.netlify/functions/client-metadata`; // NOW DYNAMIC URL
+    let client: NodeOAuthClient;
 
-    console.log('OAuth callback URLs:', {
-      redirectUri,
-      jwksUri,
-      clientId,
-      currentUrl
-    });
+    if (isDev) {
+      // LOOPBACK MODE: Use atprotoLoopbackClientMetadata and NO keyset
+      console.log('🔧 Loopback callback');
+      
+      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+      
+      client = new NodeOAuthClient({
+        clientMetadata: clientMetadata,
+        // No keyset for loopback!
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    } else {
+      // PRODUCTION MODE
+      if (!process.env.OAUTH_PRIVATE_KEY) {
+        console.error('OAUTH_PRIVATE_KEY not set');
+        return {
+          statusCode: 302,
+          headers: { 'Location': `${currentUrl}/?error=Server configuration error` },
+          body: ''
+        };
+      }
 
-    // Build metadata dynamically based on the current environment
-    const clientMetadata = {
-      client_id: clientId, // NOW DYNAMIC URL
-      client_name: 'ATlast',
-      client_uri: currentUrl,
-      redirect_uris: [redirectUri],
-      scope: 'atproto transition:generic',
-      grant_types: ['authorization_code', 'refresh_token'],
-      response_types: ['code'],
-      application_type: 'web',
-      token_endpoint_auth_method: 'private_key_jwt',
-      token_endpoint_auth_signing_alg: 'ES256',
-      dpop_bound_access_tokens: true,
-      jwks_uri: jwksUri, // NOW DYNAMIC URL
-    };
+      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
+      const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+      
+      const currentHost = process.env.DEPLOY_URL 
+        ? new URL(process.env.DEPLOY_URL).host
+        : (event.headers['x-forwarded-host'] || event.headers.host);
+      
+      currentUrl = `https://${currentHost}`;
+      const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
+      const jwksUri = `${currentUrl}/.netlify/functions/jwks`;
+      const clientId = `${currentUrl}/.netlify/functions/client-metadata`;
 
-    // Initialize OAuth client with dynamic metadata
-    const client = new NodeOAuthClient({
-      clientMetadata: clientMetadata as any,
-      keyset: [privateKey],
-      stateStore: stateStore as any,
-      sessionStore: sessionStore as any,
-    });
+      client = new NodeOAuthClient({
+        clientMetadata: {
+          client_id: clientId,
+          client_name: 'ATlast',
+          client_uri: currentUrl,
+          redirect_uris: [redirectUri],
+          scope: 'atproto transition:generic',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          token_endpoint_auth_method: 'private_key_jwt',
+          token_endpoint_auth_signing_alg: 'ES256',
+          dpop_bound_access_tokens: true,
+          jwks_uri: jwksUri,
+        } as any,
+        keyset: [privateKey],
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    }
 
     const result = await client.callback(params);
 
-    // Store a simple session mapping: sessionId -> DID
+    // Store session
     const sessionId = crypto.randomUUID();
     const did = result.session.did;
-
     await userSessions.set(sessionId, { did });
 
-    const cookieFlags = 'HttpOnly; SameSite=Lax; Max-Age=1209600; Path=/; Secure';
+    // Cookie flags - no Secure flag for loopback
+    const cookieFlags = isDev
+      ? 'HttpOnly; SameSite=Lax; Max-Age=1209600; Path=/'
+      : 'HttpOnly; SameSite=Lax; Max-Age=1209600; Path=/; Secure';
     
     return {
       statusCode: 302,
···
 
   } catch (error) {
     console.error('OAuth callback error:', error);
-    
     return {
       statusCode: 302,
       headers: {

netlify/functions/oauth-config.ts

···
 export function getOAuthConfig() {
-  // In Netlify, process.env.URL is automatically set to the public URL.
+  // Development: loopback client for local dev
+  const isDev = process.env.NODE_ENV === 'development' || process.env.NETLIFY_DEV === 'true';
+
+  if (isDev) {
+    const port = process.env.PORT || '8888';
+
+    // Special loopback client_id format with query params
+    const clientId = `http://localhost?${new URLSearchParams([
+      ['redirect_uri', `http://127.0.0.1:${port}/.netlify/functions/oauth-callback`],
+      ['scope', 'atproto transition:generic'],
+    ])}`;
+    
+    return {
+      clientId: clientId,
+      redirectUri: `http://127.0.0.1:${port}/.netlify/functions/oauth-callback`,
+      jwksUri: undefined,
+      clientType: 'loopback' as const,
+    };
+  }
+
+  // Production: discoverable client logic
   const baseUrl = process.env.URL || process.env.DEPLOY_PRIME_URL;
   
   if (process.env.NETLIFY && !process.env.URL) {
-      // This is a safety check for a critical configuration issue on Netlify
       throw new Error('process.env.URL is required in Netlify environment');
   }
   
···
     CONTEXT: process.env.CONTEXT,
     using: baseUrl
   });
-
-  const redirectUri = `${baseUrl}/.netlify/functions/oauth-callback`;
 
   return {
     clientId: `${baseUrl}/.netlify/functions/client-metadata`, // discoverable client URL
-    redirectUri,
+    redirectUri: `${baseUrl}/.netlify/functions/oauth-callback`,
     jwksUri: `${baseUrl}/.netlify/functions/jwks`,
     clientType: 'discoverable' as const,
+    usePrivateKey: true,
   };
 }

netlify/functions/oauth-start.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
-import { NodeOAuthClient } from '@atproto/oauth-client-node';
+import { NodeOAuthClient, atprotoLoopbackClientMetadata } from '@atproto/oauth-client-node';
 import { JoseKey } from '@atproto/jwk-jose';
 import { stateStore, sessionStore } from './oauth-stores-db';
 import { getOAuthConfig } from './oauth-config';
-import { initDB } from './db'; // initDB is only kept for manual setup/migrations
 
 interface OAuthStartRequestBody {
   login_hint?: string;
-  origin?: string; // The actual origin the frontend is running on
+  origin?: string;
 }
 
 function normalizePrivateKey(key: string): string {
···
 
 export const handler: Handler = async (event: HandlerEvent): Promise<HandlerResponse> => {
   try {
-    // await initDB(); 
-
-    // Parse request body
     let loginHint: string | undefined = undefined;
-    let requestOrigin: string | undefined = undefined;
     
     if (event.body) {
       const parsed: OAuthStartRequestBody = JSON.parse(event.body);
       loginHint = parsed.login_hint;
-      requestOrigin = parsed.origin;
     }
 
-    // Validate login hint is provided
     if (!loginHint) {
       return {
         statusCode: 400,
···
         body: JSON.stringify({ error: 'login_hint (handle or DID) is required' }),
       };
     }
-    
-    console.log('OAuth Start - Request origin:', requestOrigin);
 
-    // Validate private key
-    if (!process.env.OAUTH_PRIVATE_KEY) {
-      console.error('OAUTH_PRIVATE_KEY not set');
-      return {
-        statusCode: 500,
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ error: 'Server configuration error' }),
-      };
-    }
+    const config = getOAuthConfig();
+    const isDev = config.clientType === 'loopback';
 
-    // Initialize OAuth client
-    const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
-    const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+    let client: NodeOAuthClient;
 
-    // Use the dynamic config that Netlify sets for the build
-    const currentHost = process.env.DEPLOY_URL 
-      ? new URL(process.env.DEPLOY_URL).host
-      : (event.headers['x-forwarded-host'] || event.headers.host);
-
-    if (!currentHost) {
-      console.error('Missing host header in function request');
-      return {
-        statusCode: 500,
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ error: 'Server could not determine current host for redirect' }),
-      };
-    }
-
-    const currentUrl = `https://${currentHost}`;
+    if (isDev) {
+      // LOOPBACK MODE: Use atprotoLoopbackClientMetadata and NO keyset
+      console.log('🔧 Using loopback OAuth client for development');
+      console.log('Client ID:', config.clientId);
+      
+      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+      
+      client = new NodeOAuthClient({
+        clientMetadata: clientMetadata,
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    } else {
+      // PRODUCTION MODE: Full confidential client with keyset
+      console.log('🔐 Using confidential OAuth client for production');
+      
+      if (!process.env.OAUTH_PRIVATE_KEY) {
+        throw new Error('OAUTH_PRIVATE_KEY required for production');
+      }
 
-    // Now, dynamically define the URIs using the CURRENT HOST
-    const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
-    const appUrl = currentUrl;
-    const jwksUri = `${currentUrl}/.netlify/functions/jwks`;
-    const clientId = `${currentUrl}/.netlify/functions/client-metadata`;
-    
-    console.log('OAuth URLs:', {
-      redirectUri,
-      appUrl,
-      jwksUri,
-      clientId,
-      requestOrigin
-    });
+      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
+      const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
 
-    // Build metadata dynamically from environment
-    const clientMetadata = {
-      client_id: clientId,
-      client_name: 'ATlast',
-      client_uri: appUrl,
-      redirect_uris: [redirectUri],
-      scope: 'atproto transition:generic',
-      grant_types: ['authorization_code', 'refresh_token'],
-      response_types: ['code'],
-      application_type: 'web',
-      token_endpoint_auth_method: 'private_key_jwt',
-      token_endpoint_auth_signing_alg: 'ES256',
-      dpop_bound_access_tokens: true,
-      jwks_uri: jwksUri,
-    };
+      const currentHost = process.env.DEPLOY_URL 
+        ? new URL(process.env.DEPLOY_URL).host
+        : (event.headers['x-forwarded-host'] || event.headers.host);
 
-    console.log('Client metadata:', clientMetadata);
+      if (!currentHost) {
+        throw new Error('Missing host header');
+      }
 
-    // Initialize NodeOAuthClient with typed stores
-    const client = new NodeOAuthClient({
-      clientMetadata: clientMetadata as any,
-      keyset: [privateKey],
-      stateStore: stateStore as any,
-      sessionStore: sessionStore as any,
-    });
+      const currentUrl = `https://${currentHost}`;
+      const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
+      const jwksUri = `${currentUrl}/.netlify/functions/jwks`;
+      const clientId = `${currentUrl}/.netlify/functions/client-metadata`;
 
-    console.log('OAuth client initialized with redirect_uri:', redirectUri);
+      client = new NodeOAuthClient({
+        clientMetadata: {
+          client_id: clientId,
+          client_name: 'ATlast',
+          client_uri: currentUrl,
+          redirect_uris: [redirectUri],
+          scope: 'atproto transition:generic',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          token_endpoint_auth_method: 'private_key_jwt',
+          token_endpoint_auth_signing_alg: 'ES256',
+          dpop_bound_access_tokens: true,
+          jwks_uri: jwksUri,
+        } as any,
+        keyset: [privateKey],
+        stateStore: stateStore as any,
+        sessionStore: sessionStore as any,
+      });
+    }
 
-    // Generate authorization URL
     const authUrl = await client.authorize(loginHint, {
       scope: 'atproto transition:generic',
     });
···
     return {
       statusCode: 500,
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ error: 'Failed to start OAuth flow' }),
+      body: JSON.stringify({ 
+        error: 'Failed to start OAuth flow',
+        details: error instanceof Error ? error.message : 'Unknown error',
+        stack: error instanceof Error ? error.stack : undefined
+      }),
     };
   }
 };

netlify/functions/session.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from '@netlify/functions';
-import { NodeOAuthClient } from '@atproto/oauth-client-node';
+import { NodeOAuthClient, atprotoLoopbackClientMetadata } from '@atproto/oauth-client-node';
 import { JoseKey } from '@atproto/jwk-jose';
 import { stateStore, sessionStore, userSessions } from './oauth-stores-db';
 import { getOAuthConfig } from './oauth-config';
···
     // Cache miss - fetch full profile
     try {
       const config = getOAuthConfig();
-      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
-      const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
+      const isDev = config.clientType === 'loopback';
+
+      let client: NodeOAuthClient;
+
+      if (isDev) {
+        // Loopback
+        const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+        client = new NodeOAuthClient({
+          clientMetadata: clientMetadata,
+          stateStore: stateStore as any,
+          sessionStore: sessionStore as any,
+        });
+      } else {
+        // Production with private key
+        const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
+        const privateKey = await JoseKey.fromImportable(normalizedKey, 'main-key');
 
-      const client = new NodeOAuthClient({
-        clientMetadata: {
-          client_id: config.clientId,
-          client_name: 'ATlast',
-          client_uri: config.clientId.replace('/client-metadata.json', ''),
-          redirect_uris: [config.redirectUri],
-          scope: 'atproto transition:generic',
-          grant_types: ['authorization_code', 'refresh_token'],
-          response_types: ['code'],
-          application_type: 'web',
-          token_endpoint_auth_method: 'private_key_jwt',
-          token_endpoint_auth_signing_alg: 'ES256',
-          dpop_bound_access_tokens: true,
-          jwks_uri: config.jwksUri,
-        },
-        keyset: [privateKey],
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
+        client = new NodeOAuthClient({
+          clientMetadata: {
+            client_id: config.clientId,
+            client_name: 'ATlast',
+            client_uri: config.clientId.replace('/client-metadata.json', ''),
+            redirect_uris: [config.redirectUri],
+            scope: 'atproto transition:generic',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            application_type: 'web',
+            token_endpoint_auth_method: 'private_key_jwt',
+            token_endpoint_auth_signing_alg: 'ES256',
+            dpop_bound_access_tokens: true,
+            jwks_uri: config.jwksUri,
+          },
+          keyset: [privateKey],
+          stateStore: stateStore as any,
+          sessionStore: sessionStore as any,
+        });
+      }
 
       // Restore OAuth session
       const oauthSession = await client.restore(did);