An app that wants to act through your accounts has one road today: OAuth. That road assumes the app can register with every provider, keep a client secret, host a redirect URI and survive a browser round trip. A browser extension can do none of those safely. A shell script cannot. A spreadsheet cannot. So those apps ask for your password instead, or for a personal API key pasted into a settings field, and what they get is the whole account, forever, listed nowhere.
SimpleFIN solved this for bank data years ago with something smaller than OAuth. The bank gives you a token. You give it to the app. The app trades it once for a credential scoped to you and that app, and the bank keeps the list. The shape has nothing to do with money.
OpenConnection is that door, written down for anything a bridge holds: social accounts, a writer, a calendar, a wallet. The spec is at logicsrc.com/openconnection.
How it works
- You sign in at the bridge, pick the scopes, and copy a setup token. It is single use and short lived, base64url of a claim URL, so the app needs nothing else, not even a host name.
- You paste it into the app.
- The app makes one POST to the claim URL, with no credential, and names itself. It gets back an access URL and a bearer.
- Every request after that carries the bearer. The bridge enforces the scopes.
- You revoke the app at the bridge, one control beside each name. Its next call is refused with
401 revoked, and it forgets the token.
Two things differ from SimpleFIN. The bearer replaces Basic credentials in the URL, because a browser's fetch refuses a URL with credentials in it. And a second claim of the same token is refused and counted, because a token claimed twice was seen by someone it was not meant for, and you should hear about that.
There is no client registration, no redirect, no refresh token, and no credential ever passes through. A bridge that never holds a social credential says so by leaving posts out of its descriptor. OpenAccess remains the registered door, with the same scope vocabulary; a bridge that is also an OpenAccess app may hand out an OpenAccess token as the bearer, and the app need not know.
The first bridge is myna
mynaposter.com/connect is live. Sign in, tick what an app may do, copy the token. The same page lists every app holding a connection and revokes any of them. From a terminal, myna connect token makes the same token and myna connect apps shows the list.
The social profile myna serves is what a promotion tool needs: the networks you connected, a product page read into a brief, posts or comments drafted in your voice with the network's limits applied, and subreddits, hashtags, keywords and real forums from nichedb.dev. It never posts on your behalf and never holds a social credential on the cloud; that stays on your own machine, where it always was.
The first app is DefPromo
DefPromo is a browser extension for promoting your own product across fourteen networks. Until today it asked for your OpenAI key and a scraper key. Version 1.5.0 asks for one setup token instead. Paste it, and myna does the writing through your own account.
Two more things changed. Before anything scrapes a product page, the site's own /.well-known/openprofile.md and /llms.txt are read first, so a site that describes itself needs no scraper at all. And the suggestions now name real forums, from the nichedb.dev forums collection, rather than a model's guess at where people talk.
Your own keys still work. They are the second choice in Settings now, not the only one.
Run a bridge
A bridge is a table of setup tokens, a table of access tokens, a page with a copy button and a list with a revoke button, and the endpoints of whatever profile it serves. The first one took an afternoon. The spec text is CC BY 4.0.
Top comments (0)