Great, looks pretty straightforward!

Very cool! How can a third-party Bluesky client show community notes? Can they be fetched from somewhere?

Good times!

Tested it on my PDS (Bluesky PDS 0.4.169) and it works. Very easy way to make a confidential native client but only if you set the app type to "web". The Bluesky PDS implementation does not allow confidential native clients. Source code comments indicate that could change in the future though.

Using the "dynamic client id" approach may avoid some of the DCR drawbacks since only the public key originates from the client. OTOH different issues would likely arise, such as the fact that the client id will always return an "in use" public key even though it may not be in use anymore.

The DCR proposal could accomplish the same thing and looks a lot cleaner. I hope it's being considered for atproto.

blog.smokesignal.events/posts/3lvtim...

Yes, it should be doable. Just wondering if it would be seen as abusing the system. In the docs, confidential clients seem to always reside on a web server.

Hmm, I guess I can let every device register their public key on the app server and then serve dynamic client_id documents to let the device authenticate as a confidential client. Sounds a bit dodgy though.

Why can’t a native client generate a private key on first run and then be a confidential client with nice long token lifetimes?

Good suggestion! I'll put it on the todo list.

Interesting! Will this approach let the mobile client act as a confidential client and benefit from longer lived tokens?

This is very good advice!
Sign in screen updated, user experience improved.

Is this from Monkey Island?

Hope you like it! 👍🏻

You should be able to tell the browser that you don’t want autocomplete and similar features on the text field. Hopefully the browser will listen 😁

Looks amazing! A pet peeve of mine is that autocomplete and capitalization are enabled on the text field when inputting your handle on the sign in screen.