tijs.org
+7
CHANGELOG.md
+7
CHANGELOG.md
···
2
2
3
3
All notable changes to this project will be documented in this file.
4
4
5
+
## [2.3.0] - 2025-11-29
6
+
7
+
### Added
8
+
9
+
- **README improvements**: Added "Why Use This Library?" section explaining the
10
+
BFF pattern, use cases, tradeoffs, and when to consider alternatives
11
+
5
12
## [2.2.1] - 2025-11-29
6
13
7
14
### Added
+30
README.md
+30
README.md
···
6
6
Framework-agnostic OAuth integration for AT Protocol (Bluesky) applications.
7
7
Works with standard Web Request/Response APIs - no framework dependencies.
8
8
9
+
## Why Use This Library?
10
+
11
+
This library implements the
12
+
[Backend-for-Frontend (BFF) pattern](https://atproto.com/specs/oauth#confidential-client-backend-for-frontend)
13
+
for AT Protocol OAuth. Your server handles OAuth and keeps tokens secure, while
14
+
clients receive encrypted session cookies.
15
+
16
+
**Use this library when you want:**
17
+
18
+
- **Server-side token management** - OAuth tokens never leave your server,
19
+
reducing attack surface
20
+
- **Cookie-based sessions** - Works naturally with web apps and mobile WebViews
21
+
- **Framework flexibility** - Uses standard Request/Response APIs, works with
22
+
Hono, Fresh, Express, or any framework
23
+
- **Simplified mobile auth** - Mobile apps complete OAuth in a secure WebView,
24
+
no token handling required
25
+
- **Serverless-friendly** - Designed for edge runtimes like Val Town and Deno
26
+
Deploy
27
+
28
+
**Consider alternatives when:**
29
+
30
+
- You need tokens on the client device - use
31
+
[@atproto/oauth-client-browser](https://www.npmjs.com/package/@atproto/oauth-client-browser)
32
+
or
33
+
[@atproto/oauth-client-expo](https://www.npmjs.com/package/@atproto/oauth-client-expo)
34
+
- You're building a CLI tool - use
35
+
[@atproto/oauth-client-node](https://www.npmjs.com/package/@atproto/oauth-client-node)
36
+
- You need the official Bluesky SDK - see the
37
+
[AT Protocol SDK](https://atproto.blue/)
38
+
9
39
## Documentation
10
40
11
41
- **[Web Authentication Guide](./docs/web-authentication.md)** - Cookie-based