checkpoint

js/app/components/login/login.tsx

···
     >
       <ChangePDS open={open} onOpenChange={onOpenChange} />
       {/* <Text>{error}</Text> */}
-      <H3>Handle</H3>
-      <Input
-        width="100%"
-        placeholder="example.bsky.social"
-        value={handle}
-        onChangeText={(text) => setHandle(text)}
-      />
-      <Button
+      <Form
         width="100%"
-        onPress={async () => {
-          // const agent = new AtpBaseClient(url);
-          // const res = await agent.place.stream.account.login({
-          //   handleOrDID: handle,
-          // });
-          // window.location.href = res.data.redirectUrl;
-          await dispatch(login(`https://bsky.social`));
+        maxWidth={800}
+        jc="center"
+        ai="center"
+        onSubmit={async () => {
+          // onPress={async () => {
+          //   // const agent = new AtpBaseClient(url);
+          //   // const res = await agent.place.stream.account.login({
+          //   //   handleOrDID: handle,
+          //   // });
+          //   // window.location.href = res.data.redirectUrl;
+          //   await dispatch(login(`https://bsky.social`));
+          // }}
+          console.log("here we go");
+          await dispatch(login(`https://longos.iameli.link`));
         }}
-        margin="$4"
-        backgroundColor="$accentColor"
-        disabled={loginState.loading}
       >
-        <Text>{loginState.loading ? <Spinner /> : `Log in with ATProto`}</Text>
-      </Button>
+        <H3>Handle</H3>
+        <Input
+          width="100%"
+          placeholder="example.bsky.social"
+          value={handle}
+          onChangeText={(text) => setHandle(text)}
+        />
+        <Form.Trigger asChild>
+          <Button
+            width="100%"
+            margin="$4"
+            backgroundColor="$accentColor"
+            disabled={loginState.loading}
+          >
+            <Text>
+              {loginState.loading ? <Spinner /> : `Log in with ATProto`}
+            </Text>
+          </Button>
+        </Form.Trigger>
+      </Form>
     </View>
   );
 }

js/app/features/bluesky/blueskySlice.tsx

···
         if (!bluesky.client) {
           throw new Error("No client");
         }
-        const u = await bluesky.client.authorize(pds);
+        const u = await bluesky.client.authorize("scumb.ag", {});
+        console.log(u);
         thunkAPI.dispatch(openLoginLink(u.toString()));
         // cheeky 500ms delay so you don't see the text flash back
         await new Promise((resolve) => setTimeout(resolve, 500));
···
           };
         },
         rejected: (state, action) => {
+          console.error("login rejected", action.error);
           return {
             ...state,
             login: {

js/app/features/bluesky/oauthClient.tsx

···
     throw new Error("streamplaceUrl is required");
   }
   let meta: ClientMetadata;
-  // if (
-  //   streamplaceUrl.startsWith("http://localhost") ||
-  //   streamplaceUrl.startsWith("http://127.0.0.1")
-  // ) {
-  //   const isWeb = Platform.OS === "web";
-  //   const u = new URL(streamplaceUrl);
-  //   let hostname = u.hostname;
-  //   if (hostname == "localhost") {
-  //     hostname = "127.0.0.1";
-  //   }
-  //   let redirect = `${u.protocol}//${hostname}`;
-  //   if (u.port !== "") {
-  //     redirect = `${redirect}:${u.port}`;
-  //   }
-  //   if (isWeb) {
-  //     redirect = `${redirect}/login`;
-  //   } else {
-  //     const scheme = Constants.expoConfig?.scheme;
-  //     if (!scheme) {
-  //       throw new Error("unable to resolve scheme for oauth redirect");
-  //     }
-  //     redirect = `${redirect}/app-return/${scheme}`;
-  //   }
-  //   const queryParams = new URLSearchParams();
-  //   queryParams.set("scope", "atproto transition:generic");
-  //   queryParams.set("redirect_uri", redirect);
-  //   meta = {
-  //     client_id: `http://localhost?${queryParams.toString()}`,
-  //     redirect_uris: [redirect as any],
-  //     scope: "atproto transition:generic",
-  //     token_endpoint_auth_method: "none",
-  //     client_name: "Loopback client",
-  //     response_types: ["code"],
-  //     grant_types: ["authorization_code", "refresh_token"],
-  //     // > There is a special exception for the localhost development workflow [ ... ]
-  //     // > These clients use web URLs, but have application_type set to native in the generated client metadata.
-  //     application_type: "native",
-  //     dpop_bound_access_tokens: true,
-  //   };
-  // } else {
-  //   const res = await fetch(
-  //     `${streamplaceUrl}/api/atproto-oauth/${Platform.OS}`,
-  //   );
-  //   meta = await res.json();
-  // }
-  meta = {
-    redirect_uris: [
-      "https://longos.iameli.link/xrpc/place.stream.account.oauthReturn",
-    ],
-    response_types: ["code"],
-    grant_types: ["authorization_code", "refresh_token"],
-    scope: "atproto transition:generic",
-    token_endpoint_auth_method: "none",
-    application_type: "web",
-    client_id: "https://longos.iameli.link/api/atproto-oauth/web",
-    client_name: "Streamplace",
-    client_uri: "https://longos.iameli.link",
-    dpop_bound_access_tokens: true,
-  };
+  if (
+    streamplaceUrl.startsWith("http://localhost") ||
+    streamplaceUrl.startsWith("http://127.0.0.1")
+  ) {
+    const isWeb = Platform.OS === "web";
+    const u = new URL(streamplaceUrl);
+    let hostname = u.hostname;
+    if (hostname == "localhost") {
+      hostname = "127.0.0.1";
+    }
+    let redirect = `${u.protocol}//${hostname}`;
+    if (u.port !== "") {
+      redirect = `${redirect}:${u.port}`;
+    }
+    if (isWeb) {
+      redirect = `${redirect}/login`;
+    } else {
+      const scheme = Constants.expoConfig?.scheme;
+      if (!scheme) {
+        throw new Error("unable to resolve scheme for oauth redirect");
+      }
+      redirect = `${redirect}/app-return/${scheme}`;
+    }
+    const queryParams = new URLSearchParams();
+    queryParams.set("scope", "atproto transition:generic");
+    queryParams.set("redirect_uri", redirect);
+    meta = {
+      client_id: `http://localhost?${queryParams.toString()}`,
+      redirect_uris: [redirect as any],
+      scope: "atproto transition:generic",
+      token_endpoint_auth_method: "none",
+      client_name: "Loopback client",
+      response_types: ["code"],
+      grant_types: ["authorization_code", "refresh_token"],
+      // > There is a special exception for the localhost development workflow [ ... ]
+      // > These clients use web URLs, but have application_type set to native in the generated client metadata.
+      application_type: "native",
+      dpop_bound_access_tokens: true,
+    };
+  } else {
+    const res = await fetch(
+      `${streamplaceUrl}/api/atproto-oauth/downstream/${Platform.OS}`,
+    );
+    meta = await res.json();
+  }
   clientMetadataSchema.parse(meta);
   return new ReactNativeOAuthClient({
-    fetch: (input, init) => {
+    fetch: async (input, init) => {
+      // Normalize input to a Request object
+      let request: Request;
+      if (typeof input === "string" || input instanceof URL) {
+        request = new Request(input, init);
+      } else {
+        request = input;
+      }
+
+      // If we're making a request to the PLC directory, use our custom endpoint
+      if (request.url.includes("plc.directory")) {
+        const res = await fetch(request, init);
+        if (!res.ok) {
+          return res;
+        }
+        const data = await res.json();
+        const service = data.service.find((s: any) => s.id === "#atproto_pds");
+        if (!service) {
+          return res;
+        }
+        service.serviceEndpoint = streamplaceUrl;
+        return new Response(JSON.stringify(data), {
+          status: res.status,
+          headers: res.headers,
+        });
+      }
+
       console.log("!!!!!! fetch", input, init);
-      return fetch(input, init);
+      return fetch(request, init);
     },
     handleResolver: "https://bsky.social", // backend instances should use a DNS based resolver
     responseMode: "query", // or "fragment" (frontend only) or "form_post" (backend only)

pkg/api/api.go

···
 	"net/http/httputil"
 	"net/url"
 	"os"
-	"slices"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/NYTimes/gziphandler"
 	"github.com/bluesky-social/indigo/api/bsky"
-	"github.com/haileyok/atproto-oauth-golang/helpers"
 	"github.com/julienschmidt/httprouter"
 	"github.com/rs/cors"
 	sloghttp "github.com/samber/slog-http"
···
 // api/playback/iame.li/hls/source/stream.m3u8
 // api/playback/iame.li/hls/source/000000000000.ts
 
-func generateOAuthServerMetadata(host string) map[string]any {
-	oauthServerMetadata := map[string]any{
-		"issuer":                                         fmt.Sprintf("https://%s", host),
-		"request_parameter_supported":                    true,
-		"request_uri_parameter_supported":                true,
-		"require_request_uri_registration":               true,
-		"scopes_supported":                               []string{"atproto", "transition:generic", "transition:chat.bsky"},
-		"subject_types_supported":                        []string{"public"},
-		"response_types_supported":                       []string{"code"},
-		"response_modes_supported":                       []string{"query", "fragment", "form_post"},
-		"grant_types_supported":                          []string{"authorization_code", "refresh_token"},
-		"code_challenge_methods_supported":               []string{"S256"},
-		"ui_locales_supported":                           []string{"en-US"},
-		"display_values_supported":                       []string{"page", "popup", "touch"},
-		"authorization_response_iss_parameter_supported": true,
-		"request_object_encryption_alg_values_supported": []string{},
-		"request_object_encryption_enc_values_supported": []string{},
-		"jwks_uri":                              fmt.Sprintf("https://%s/oauth/jwks", host),
-		"authorization_endpoint":                fmt.Sprintf("https://%s/oauth/authorize", host),
-		"token_endpoint":                        fmt.Sprintf("https://%s/oauth/token", host),
-		"token_endpoint_auth_methods_supported": []string{"none", "private_key_jwt"},
-		"revocation_endpoint":                   fmt.Sprintf("https://%s/oauth/revoke", host),
-		"introspection_endpoint":                fmt.Sprintf("https://%s/oauth/introspect", host),
-		"pushed_authorization_request_endpoint": fmt.Sprintf("https://%s/oauth/par", host),
-		"require_pushed_authorization_requests": true,
-		"client_id_metadata_document_supported": true,
-		"request_object_signing_alg_values_supported": []string{
-			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
-			"ES256", "ES256K", "ES384", "ES512", "none",
-		},
-		"token_endpoint_auth_signing_alg_values_supported": []string{
-			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
-			"ES256", "ES256K", "ES384", "ES512",
-		},
-		"dpop_signing_alg_values_supported": []string{
-			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
-			"ES256", "ES256K", "ES384", "ES512",
-		},
-	}
-	return oauthServerMetadata
-}
-
 func (a *StreamplaceAPI) Handler(ctx context.Context) (http.Handler, error) {
 	xrpc, err := spxrpc.NewServer(a.CLI, a.Model)
 	if err != nil {
···
 	apiRouter.HandlerFunc("POST", "/api/notification", a.HandleNotification(ctx))
 	// old clients
 	router.HandlerFunc("GET", "/app-updates", a.HandleAppUpdates(ctx))
-	router.HandlerFunc("GET", "/.well-known/oauth-authorization-server", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(200)
-		json.NewEncoder(w).Encode(generateOAuthServerMetadata("longos.iameli.link"))
-	})
-	router.HandlerFunc("GET", "/.well-known/oauth-protected-resource", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.WriteHeader(404)
-	})
+	router.HandlerFunc("GET", "/.well-known/oauth-authorization-server", a.HandleOAuthAuthorizationServer(ctx))
+	router.HandlerFunc("GET", "/.well-known/oauth-protected-resource", a.HandleOAuthProtectedResource(ctx))
 
 	// new ones
 	apiRouter.HandlerFunc("GET", "/api/manifest", a.HandleAppUpdates(ctx))
···
 	apiRouter.GET("/api/segment/recent/:repoDID", a.HandleUserRecentSegments(ctx))
 	apiRouter.GET("/api/bluesky/resolve/:handle", a.HandleBlueskyResolve(ctx))
 	for _, platform := range atproto.AllowedPlatforms {
-		apiRouter.GET(fmt.Sprintf("/api/atproto-oauth/%s", platform), a.HandleATProtoOAuth(ctx, platform))
+		apiRouter.GET(fmt.Sprintf("/api/atproto-oauth/upstream/%s", platform), a.HandleATProtoOAuthUpstream(ctx, platform))
+		apiRouter.GET(fmt.Sprintf("/api/atproto-oauth/downstream/%s", platform), a.HandleATProtoOAuthDownstream(ctx, platform))
 	}
 	apiRouter.GET("/api/atproto-oauth/jwks.json", a.HandleJWKPublic(ctx))
 	apiRouter.GET("/api/live-users", a.HandleLiveUsers(ctx))
 	apiRouter.GET("/api/view-count/:user", a.HandleViewCount(ctx))
+	apiRouter.HandlerFunc("POST", "/api/oauth/par", a.HandleOAuthPAR(ctx))
 	apiRouter.NotFound = a.HandleAPI404(ctx)
 	router.Handler("GET", "/api/*resource", apiRouter)
 	router.Handler("POST", "/api/*resource", apiRouter)
···
 			apierrors.WriteHTTPInternalServerError(w, "could not marshal signing keys", err)
 			return
 		}
-		w.Write(bs)
-	}
-}
-
-func (a *StreamplaceAPI) HandleATProtoOAuth(ctx context.Context, platform string) httprouter.Handle {
-	return func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		host, _, err := net.SplitHostPort(req.Host)
-		if err != nil {
-			host = req.Host
-		}
-		if !slices.Contains(atproto.AllowedPlatforms, platform) {
-			apierrors.WriteHTTPBadRequest(w, "unsupported platform", nil)
-			return
-		}
-
-		meta := atproto.GetMetadata(host, platform, a.CLI.AppBundleID)
-		bs, err := json.Marshal(meta)
-		if err != nil {
-			apierrors.WriteHTTPInternalServerError(w, "could not marshal metadata", err)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		w.Write(bs)
-	}
-}
-
-func (a *StreamplaceAPI) HandleJWKPublic(ctx context.Context) httprouter.Handle {
-	return func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		pubKey, err := a.CLI.JWK.PublicKey()
-		if err != nil {
-			apierrors.WriteHTTPInternalServerError(w, "could not get public key", err)
-			return
-		}
-		bs, err := json.Marshal(helpers.CreateJwksResponseObject(pubKey))
-		if err != nil {
-			apierrors.WriteHTTPInternalServerError(w, "could not marshal public key", err)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
 		w.Write(bs)
 	}
 }

pkg/api/oauth.go

···
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"slices"
+
+	"github.com/haileyok/atproto-oauth-golang/helpers"
+	"github.com/julienschmidt/httprouter"
+	"stream.place/streamplace/pkg/atproto"
+	apierrors "stream.place/streamplace/pkg/errors"
+)
+
+func (a *StreamplaceAPI) HandleATProtoOAuthUpstream(ctx context.Context, platform string) httprouter.Handle {
+	return func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
+		host, _, err := net.SplitHostPort(req.Host)
+		if err != nil {
+			host = req.Host
+		}
+		if !slices.Contains(atproto.AllowedPlatforms, platform) {
+			apierrors.WriteHTTPBadRequest(w, "unsupported platform", nil)
+			return
+		}
+
+		meta := atproto.GetUpstreamMetadata(host, platform, a.CLI.AppBundleID)
+		bs, err := json.Marshal(meta)
+		if err != nil {
+			apierrors.WriteHTTPInternalServerError(w, "could not marshal metadata", err)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(bs)
+	}
+}
+
+func (a *StreamplaceAPI) HandleATProtoOAuthDownstream(ctx context.Context, platform string) httprouter.Handle {
+	return func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
+		host, _, err := net.SplitHostPort(req.Host)
+		if err != nil {
+			host = req.Host
+		}
+		if !slices.Contains(atproto.AllowedPlatforms, platform) {
+			apierrors.WriteHTTPBadRequest(w, "unsupported platform", nil)
+			return
+		}
+
+		meta := atproto.GetDownstreamMetadata(host, platform, a.CLI.AppBundleID)
+		bs, err := json.Marshal(meta)
+		if err != nil {
+			apierrors.WriteHTTPInternalServerError(w, "could not marshal metadata", err)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(bs)
+	}
+}
+
+func (a *StreamplaceAPI) HandleJWKPublic(ctx context.Context) httprouter.Handle {
+	return func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
+		pubKey, err := a.CLI.JWK.PublicKey()
+		if err != nil {
+			apierrors.WriteHTTPInternalServerError(w, "could not get public key", err)
+			return
+		}
+		bs, err := json.Marshal(helpers.CreateJwksResponseObject(pubKey))
+		if err != nil {
+			apierrors.WriteHTTPInternalServerError(w, "could not marshal public key", err)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(bs)
+	}
+}
+
+func generateOAuthServerMetadata(host string) map[string]any {
+	oauthServerMetadata := map[string]any{
+		"issuer":                                         fmt.Sprintf("https://%s", host),
+		"request_parameter_supported":                    true,
+		"request_uri_parameter_supported":                true,
+		"require_request_uri_registration":               true,
+		"scopes_supported":                               []string{"atproto", "transition:generic", "transition:chat.bsky"},
+		"subject_types_supported":                        []string{"public"},
+		"response_types_supported":                       []string{"code"},
+		"response_modes_supported":                       []string{"query", "fragment", "form_post"},
+		"grant_types_supported":                          []string{"authorization_code", "refresh_token"},
+		"code_challenge_methods_supported":               []string{"S256"},
+		"ui_locales_supported":                           []string{"en-US"},
+		"display_values_supported":                       []string{"page", "popup", "touch"},
+		"authorization_response_iss_parameter_supported": true,
+		"request_object_encryption_alg_values_supported": []string{},
+		"request_object_encryption_enc_values_supported": []string{},
+		"jwks_uri":                              fmt.Sprintf("https://%s/api/oauth/jwks", host),
+		"authorization_endpoint":                fmt.Sprintf("https://%s/api/oauth/authorize", host),
+		"token_endpoint":                        fmt.Sprintf("https://%s/api/oauth/token", host),
+		"token_endpoint_auth_methods_supported": []string{"none", "private_key_jwt"},
+		"revocation_endpoint":                   fmt.Sprintf("https://%s/api/oauth/revoke", host),
+		"introspection_endpoint":                fmt.Sprintf("https://%s/api/oauth/introspect", host),
+		"pushed_authorization_request_endpoint": fmt.Sprintf("https://%s/api/oauth/par", host),
+		"require_pushed_authorization_requests": true,
+		"client_id_metadata_document_supported": true,
+		"request_object_signing_alg_values_supported": []string{
+			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
+			"ES256", "ES256K", "ES384", "ES512", "none",
+		},
+		"token_endpoint_auth_signing_alg_values_supported": []string{
+			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
+			"ES256", "ES256K", "ES384", "ES512",
+		},
+		"dpop_signing_alg_values_supported": []string{
+			"RS256", "RS384", "RS512", "PS256", "PS384", "PS512",
+			"ES256", "ES256K", "ES384", "ES512",
+		},
+	}
+	return oauthServerMetadata
+}
+
+func (a *StreamplaceAPI) HandleOAuthAuthorizationServer(ctx context.Context) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(200)
+		json.NewEncoder(w).Encode(generateOAuthServerMetadata("longos.iameli.link"))
+	}
+}
+
+func (a *StreamplaceAPI) HandleOAuthProtectedResource(ctx context.Context) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(200)
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"resource": "https://longos.iameli.link",
+			"authorization_servers": []string{
+				"https://longos.iameli.link",
+			},
+			"scopes_supported": []string{},
+			"bearer_methods_supported": []string{
+				"header",
+			},
+			"resource_documentation": "https://atproto.com",
+		})
+	}
+}
+
+func (a *StreamplaceAPI) HandleOAuthPAR(ctx context.Context) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(201)
+		json.NewEncoder(w).Encode(map[string]any{
+			"request_uri": "urn:ietf:params:oauth:request_uri:req-b963542aeeaebe427f8ee5c6dd095ff0",
+			"expires_in":  299,
+		})
+	}
+}
+func (a *StreamplaceAPI) HandlePLC(ctx context.Context) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(201)
+		json.NewEncoder(w).Encode(map[string]any{
+			"@context": []string{
+				"https://www.w3.org/ns/did/v1",
+				"https://w3id.org/security/multikey/v1",
+				"https://w3id.org/security/suites/secp256k1-2019/v1",
+			},
+			"id": "did:plc:dkh4rwafdcda4ko7lewe43ml",
+			"alsoKnownAs": []string{
+				"at://scumb.ag",
+			},
+			"verificationMethod": []map[string]string{
+				{
+					"id":                 "did:plc:dkh4rwafdcda4ko7lewe43ml#atproto",
+					"type":               "Multikey",
+					"controller":         "did:plc:dkh4rwafdcda4ko7lewe43ml",
+					"publicKeyMultibase": "zQ3shMdd6GA2eefzDHPoTGmtt1D8tTfbE7MqBzrF9Dv78m5Lr",
+				},
+			},
+			"service": []map[string]string{
+				{
+					"id":              "#atproto_pds",
+					"type":            "AtprotoPersonalDataServer",
+					"serviceEndpoint": "https://milkcap.us-west.host.bsky.network",
+				},
+			},
+		})
+	}
+}

pkg/atproto/client_metadata.go

···
 	return &b
 }
 
-func GetMetadata(host string, platform string, appBundleId string) *OAuthClientMetadata {
+func GetUpstreamMetadata(host string, platform string, appBundleId string) *OAuthClientMetadata {
 	meta := &OAuthClientMetadata{
-		ClientID:  fmt.Sprintf("https://%s/api/atproto-oauth/%s", host, platform),
+		ClientID:  fmt.Sprintf("https://%s/api/atproto-oauth/upstream/%s", host, platform),
 		JwksURI:   fmt.Sprintf("https://%s/api/atproto-oauth/jwks.json", host),
 		ClientURI: fmt.Sprintf("https://%s", host),
 		// RedirectURIs:            []string{fmt.Sprintf("https://%s/login", host)},
···
 		DPoPBoundAccessTokens:       boolPtr(true),
 		TokenEndpointAuthSigningAlg: "ES256",
 	}
-
-	// metadata := map[string]any{
-	// 	"client_id":                       serverMetadataUrl,
-	// 	"client_name":                     "Atproto Oauth Golang Tester",
-	// 	"client_uri":                      serverUrlRoot,
-	// 	"logo_uri":                        fmt.Sprintf("%s/logo.png", serverUrlRoot),
-	// 	"tos_uri":                         fmt.Sprintf("%s/tos", serverUrlRoot),
-	// 	"policy_url":                      fmt.Sprintf("%s/policy", serverUrlRoot),
-	// 	"redirect_uris":                   []string{serverCallbackUrl},
-	// 	"grant_types":                     []string{"authorization_code", "refresh_token"},
-	// 	"response_types":                  []string{"code"},
-	// 	"application_type":                "web",
-	// 	"dpop_bound_access_tokens":        true,
-	// 	"jwks_uri":                        fmt.Sprintf("%s/oauth/jwks.json", serverUrlRoot),
-	// 	"scope":                           "atproto transition:generic",
-	// 	"token_endpoint_auth_method":      "private_key_jwt",
-	// 	"token_endpoint_auth_signing_alg": "ES256",
-	// }
 
 	if platform == "web" {
 		meta.RedirectURIs = []string{fmt.Sprintf("https://%s/xrpc/place.stream.account.oauthReturn", host)}
+		meta.ApplicationType = "web"
+	} else {
+		meta.RedirectURIs = []string{fmt.Sprintf("https://%s/api/app-return/%s", host, appBundleId)}
+		meta.ApplicationType = "native"
+	}
+	return meta
+}
+
+func GetDownstreamMetadata(host string, platform string, appBundleId string) *OAuthClientMetadata {
+	meta := &OAuthClientMetadata{
+		ClientID:  fmt.Sprintf("https://%s/api/atproto-oauth/downstream/%s", host, platform),
+		ClientURI: fmt.Sprintf("https://%s", host),
+		// RedirectURIs:            []string{fmt.Sprintf("https://%s/login", host)},
+		Scope:                   "atproto transition:generic",
+		TokenEndpointAuthMethod: "none",
+		ClientName:              "Streamplace",
+		ResponseTypes:           []string{"code"},
+		GrantTypes:              []string{"authorization_code", "refresh_token"},
+		DPoPBoundAccessTokens:   boolPtr(true),
+	}
+	if platform == "web" {
+		meta.RedirectURIs = []string{fmt.Sprintf("https://%s/login", host)}
 		meta.ApplicationType = "web"
 	} else {
 		meta.RedirectURIs = []string{fmt.Sprintf("https://%s/api/app-return/%s", host, appBundleId)}

pkg/atproto/oauth.go pkg/atproto/oauth_upstream.go

···
 )
 
 func Login(ctx context.Context, cli *config.CLI, input *streamplace.AccountLogin_Input, mod model.Model) (*streamplace.AccountDefs_LoginResponse, error) {
-	meta := GetMetadata("longos.iameli.link", "web", "")
+	meta := GetUpstreamMetadata("longos.iameli.link", "web", "")
 	oclient, err := oauth.NewClient(oauth.ClientArgs{
 		ClientJwk:   cli.JWK,
 		ClientId:    meta.ClientID,
···
 }
 
 func HandleOauthReturn(ctx context.Context, cli *config.CLI, code string, iss string, state string, mod model.Model) error {
-	meta := GetMetadata("longos.iameli.link", "web", "")
+	meta := GetUpstreamMetadata("longos.iameli.link", "web", "")
 	oclient, err := oauth.NewClient(oauth.ClientArgs{
 		ClientJwk:   cli.JWK,
 		ClientId:    meta.ClientID,