hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(oauth): support the profile scope

Browse source 
A token with only the profile scope can call verify_credentials, as in
Mastodon 4.3. The answer is the public account, so apps can use it to
log users in without seeing their email or settings.
This commit is contained in:
Lain Soykaf 2026-10-26 12:26:07 +04:00
commit 530ae4b339
No known key found for this signature in database
7 changed files with 90 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/development/API/differences_in_mastoapi_responses.md
View file

@ -303,6 +303,10 @@ Additional fields are returned in the response:
- `id`: The primary key of this token in Pleroma's database.
- `me` (user tokens only): The ActivityPub ID of the user who owns the token.
### `profile` scope
As in Mastodon 4.3, a token with the `profile` scope can call `GET /api/v1/accounts/verify_credentials` and no other Mastodon API endpoint. Apps can use it to log users in with their fediverse account. Unless the token also has `read` or `read:accounts`, Pleroma returns only public data: unlike Mastodon, there is no `source.privacy`, no `follow_requests_count`, and none of the private `pleroma` fields such as `email`, `settings_store` and `chat_token`.
## Account Registration
`POST /api/v1/accounts`