OAuth PAR request mixes transition and granular scopes, blocking login

[sophiixyz]

Steps to Reproduce

Reproduction: attempt sign-in on blacksky.community with any handle whose PDS enforces this scope-family separation. (for me this is tranquil.farm)

Attachments

2026-08-16-211747_1273x678_scrot.png

What platform(s) does this occur on?

Web (Desktop)

Device Info

NixOS

What version of the app are you using?

the one currently on bluesky.community

Additional Information

Signing in with an atproto handle on blacksky.community fails at the PAR step with invalid_scope. My PDS (tranquil.farm) returns 400.

The scope string sent in the PAR request body is:

atproto transition:generic transition:email transition:chat.bsky identity:handle account:email?action=manage account:status?action=manage

This mixes transition scopes (transition:generic, transition:email, transition:chat.bsky) with granular scopes (identity:handle, account:email?action=manage, account:status?action=manage) in one request. Per the atproto OAuth spec, these are mutually exclusive — a client should request one family or the other, not both. My PDS correctly rejects the combined request.

Response from PDS:

{
    "error": "invalid_scope",
    "error_description": "Cannot mix transition scopes with granular scopes. Use either transition:* scopes OR granular scopes (repo:*, blob:*, rpc:*, account:*, include:*), not both."
}

[tristanjodsalz]

For reference: witchsky had the same issue as they are based on this code (as I understand): https://tangled.org/jollywhoppers.com/witchsky.app/issues/102