Prepare for production

app/.well-known/jwks.json/route.ts

···
+import { NextResponse } from "next/server";
+import { JoseKey } from "@atproto/oauth-client-node";
+
+// Serves the public keys for the OAuth client
+// Required for confidential clients using private_key_jwt authentication
+
+const PRIVATE_KEY = process.env.PRIVATE_KEY;
+
+export async function GET() {
+  if (!PRIVATE_KEY) {
+    return NextResponse.json({ keys: [] });
+  }
+
+  const key = await JoseKey.fromJWK(JSON.parse(PRIVATE_KEY));
+  return NextResponse.json({
+    keys: [key.publicJwk],
+  });
+}

lib/auth/client.ts

···
+
 import {
   NodeOAuthClient,
   buildAtprotoLoopbackClientMetadata,
+  JoseKey,
+  Keyset,
 } from "@atproto/oauth-client-node";
 import type {
   NodeSavedSession,
   NodeSavedState,
+  OAuthClientMetadataInput,
 } from "@atproto/oauth-client-node";
 import { getDb } from "../db";
 
···
 globalAuth.stateStore ??= new Map();
 globalAuth.sessionStore ??= new Map();
 
+const PUBLIC_URL = process.env.PUBLIC_URL;
+const PRIVATE_KEY = process.env.PRIVATE_KEY;
+
 let client: NodeOAuthClient | null = null;
 
+function getClientMetadata(): OAuthClientMetadataInput {
+    if (PUBLIC_URL) {
+        return {
+            client_id: `${PUBLIC_URL}/oauth-client-metadata.json`,
+            client_name: "indiemusi.ch",
+            client_uri: PUBLIC_URL,
+            redirect_uris: [`${PUBLIC_URL}/oauth/callback`],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            scope: SCOPE,
+            token_endpoint_auth_method: "private_key_jwt" as const,
+            token_endpoint_auth_signing_alg: "ES256" as const, // must match the alg in scripts/gen-key.ts
+            jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`,
+            dpop_bound_access_tokens: true,
+        };
+    } else {
+        return buildAtprotoLoopbackClientMetadata({
+            scope: SCOPE,
+            redirect_uris: ["http://127.0.0.1:3000/oauth/callback"],
+        });
+    }
+}
+
+async function getKeyset(): Promise<Keyset | undefined> {
+    if (PUBLIC_URL && PRIVATE_KEY) {
+        return new Keyset([await JoseKey.fromJWK(JSON.parse(PRIVATE_KEY))]);
+    } else {
+        return undefined;
+    }
+}
+
 export async function getOAuthClient(): Promise<NodeOAuthClient> {
   if (client) return client;
 
   client = new NodeOAuthClient({
-    clientMetadata: buildAtprotoLoopbackClientMetadata({
-      scope: SCOPE,
-      redirect_uris: ["http://127.0.0.1:3000/oauth/callback"],
-    }),
+    clientMetadata: getClientMetadata(),
+    keyset: await getKeyset(),
   
   stateStore: {
     async get(key: string) {

package.json

···
     "build": "next build",
     "start": "pnpm migrate && next start",
     "lint": "eslint",
-    "migrate": "tsx scripts/migrate.ts"
+    "migrate": "tsx scripts/migrate.ts",
+    "gen-key": "tsx scripts/gen-key.ts"
   },
   "dependencies": {
     "@atproto/lex": "^0.0.20",

scripts/gen-key.ts

···
+import { JoseKey } from "@atproto/oauth-client-node";
+
+async function main() {
+  const kid = Date.now().toString();
+  const key = await JoseKey.generate(["ES256"], kid);
+  console.log(JSON.stringify(key.privateJwk));
+};
+
+main();