maybe besides the point but I think it would be more user-friendly if it did the extra hop to resolve the authorization server (i.e. bsky.social )

lol yeah good point - I’d probably just hardcode .host.bsky.network -> bsky.social

noooooooooooo pls use /.well-known/oauth-protected-resource

fiiiine

although in fairness I think it’s gonna be a while until some else reinvents entryway

I've contemplated a separate subdomain for the authz endpoints in millipds (it's good for security™)