OAuth: an app is identified by a public metadata URL with no secret; login happens at the PDS or its entryway, the authorization server; PAR, PKCE and DPoP are required so tokens are bound to a per-session key; app passwords are the old way.

Third-party apps are the point of an open network, and this is how they are safe.

This is OAuth, the web's login handshake. An app identifies itself with a URL: a public metadata document. No registration form, no shared secret.

You log in at your host, or at the login service your host names. Never inside the app. That host or service is the authorization server.

Three protections are mandatory. PAR, a pushed request. PKCE, a code challenge. And DPoP: tokens bound to a key this copy of the app made for this session.

A stolen token is useless somewhere else. It is a key cut for one lock: bound to the key that asked.

App passwords are the old way: a second password, nearly full access. OAuth replaces them with scopes: named permissions, next.

Check yourself. What binds an access token to one app instance?