For the #ActivityPubAPI, we need a profile of OAuth to use for accessing the actor's data. There's a suggested flow here:

https://github.com/swicg/activitypub-api/blob/main/OAuth%202.0%20for%20ActivityPub%20Activity%20Diagram.png

There's an example client here:

https://swicg.github.io/activitypub-api/examples/oauth/index.html

It tries discovery via RFC 8414 or getting the endpoints straight from the actor.

It then provisions a client ID using CIMD, FEP d8c2, or DCR (in that order).

It then tries to do an authorization code flow.

I'm interested in seeing it tested with more ActivityPub API servers.

#ActivityPub

activitypub-api/OAuth 2.0 for ActivityPub Activity Diagram.png at main · swicg/activitypub-api

ActivityPub API Task Force repository. Contribute to swicg/activitypub-api development by creating an account on GitHub.

^GitHub