Support Webfinger for OAuth2

When looking at a Mastodon account like mike@chinwag.org we cannot assume that chinwag.org is also the instance for API calls. Here's what we should do instead:

Webfinger
As said earlier, each Mastodon user has an acct: URI, which is used for discovery and authentication. When you add @user@example.org, a webfinger query is performed. This is done in two steps:
1. Querying https://example.org/.well-known/host-meta (where the domain of the URL matches the domain part of the acct: URI) to get information on how to perform the query. This file will indeed contain a URL template of the form https://somedomain.org/.well-known/webfinger?resource={uri} that will be used in the second step.
2. Fill the returned template with the acct: URI to be queried and perform the query: https://somedomain.org/.well-known/webfinger?resource=acct:user@example.org
Mastodon documentation

Tags: Open

Close issue

Comments


This wiki uses a variant of Markdown.

To save this page you must answer this question:

Please write "new issue" into the field below.