Delete This Post

This action will delete this post on this instance and on all federated instances, and it cannot be undone. Are you certain you want to delete this post?

No
Yes
Block This Actor

This action will block this actor and hide all of their past and future posts. Are you certain you want to block this actor?

No
Yes
Block This Object

This action will block this object. Are you certain you want to block this object?

No
Yes
Delete OAuth Client

Are you sure you want to delete the OAuth client [Client Name]? This action cannot be undone and will revoke all access tokens for this client.

No
Yes
Revoke OAuth Token

Are you sure you want to revoke the OAuth token [Token ID]? This action cannot be undone and will immediately revoke access for this token.

No
Yes
Todd Sundsted
Todd Sundsted posted Nov 11, 2025

Okay, my analysis is complete! Here are the core changes to Ktistec required for Mastodon API compatibility:

  • PKCE (Proof Key for Code Exchange) must be optional: Because Mastodon makes PKCE optional, clients don't support it, which means other servers can't require it. PKCE (and the code_challenge parameter) ensures that an authorization code can only be exchanged by the client that initiated the OAuth request.
  • Support for the client_credentials grant type: The client_credentials grant type is used to grant a client app-level access without requiring user authentication. Mastodon requires this for some of its "public" API endpoints. This necessitates a change to the database schema to allow a null account id in the client secrets table.
  • Addition of a created_at timestamp property: Mastodon requires a non-standard created_at property in the body of the /oauth/token endpoint response instead of (in addition to) the standard expires_in property.
  • Support for both form-encoded and JSON request bodies: This isn't a Mastodon requirement per se but popular clients clearly demand some latitude in what they send.
  • WebFinger must accept requests with no resource parameter: This is honestly a bug on my part.
  • Mastodon-compatible endpoints: A boatload of them. Clients expect many endpoints and don't gracefully degrade if they're not present. Really I should just implement features like pinned posts and bookmarks...

The only thing here that gives me heartburn is that PKCE is not required.

#ktistec #mastodonapi #oauth