500 error on POST /api/v1/auth/atproto/service-auth with valid PDS-signed JWT

[zhiganov]

We're integrating avails (ATProto-powered group scheduling) with OpenMeet's calendar availability API. The ATProto service auth token exchange returns 500.

What we're doing:

1. User signs into avails via ATProto OAuth (Bluesky)
2. Our server calls com.atproto.server.getServiceAuth on the user's PDS with:
   • aud: did:web:api.openmeet.net
   • lxm: net.openmeet.auth
3. PDS returns a signed JWT (this step succeeds)
4. We POST the JWT to https://api.openmeet.net/api/v1/auth/atproto/service-auth with:
   • Content-Type: application/json
   • x-tenant-id: 1
   • Body: { "token": "<pds-signed-jwt>" }
5. Response: 500 Internal Server Error

{"statusCode":500,"message":"Internal server error","path":"/api/v1/auth/atproto/service-auth","timestamp":"2026-04-03T12:44:19.676Z"}

Previous error (before adding lxm):

{"statusCode":401,"message":"Invalid lexicon method"}

Adding lxm: net.openmeet.auth resolved that, but now we get 500.

User DID: did:plc:7t3rryg4ck5ifux2jokclglk (has an OpenMeet account, signed up via Bluesky)

Our goal: Exchange the service auth JWT for OpenMeet tokens, then use the bearer token to call POST /api/external-calendar/events to fetch the user's calendar availability and show it in our scheduling grid.

Context: avails is an open-source LettuceMeet alternative on ATProto. We want to use OpenMeet as the calendar availability layer so users connect their calendar once on OpenMeet and every ATProto app benefits. Integration issue.

[tompscanlan]

First, try using x-tenant-id: lsdfaopkljdfs. This is the general public instance tenant. Be a little careful, as this is production, but you shouldn't be able to break things easily.

Are you only after the external events? The google/outlook code is not well traveled, so there are possible bugs. Let me know what you run into and I'll fix it as you find it.

[zhiganov]

Thanks @tompscanlan — the tenant ID fix worked! Service auth token exchange now succeeds.

To answer your question — yes, we're after external calendar events (Google/Outlook). We show them as busy times on the scheduling grid so participants can see conflicts when picking a time. Happy to report bugs as we hit them.

Two things we ran into:

1. Event publishing — 401 on /api/integration/events
   We're trying to create an event after a meeting time is finalized. Using the bearer token from the service auth exchange:

POST /api/integration/events
Authorization: Bearer
x-tenant-id: lsdfaopkljdfs

Response: {"statusCode":401,"message":"Invalid authentication credentials"}

Does this endpoint need a different auth method (e.g. an API key)? Or is there a different endpoint for creating events on behalf of a user?

2. Calendar availability — response shape
   POST /api/external-calendar/events returns successfully but the response isn't an array — we get a crash on .map(). What's the expected response shape?

[tompscanlan]

I hadn't anticipated this particular use case, so this is kind of clunky. We could come up with an endpoint that returns all busy slots in a date range. It would include atproto events, private/unlisted events that aren't on atproto, and externally sourced events, leaving out unneeded details.

For today:

1: use POST /api/events (not /api/integration/events), the JWT from service-auth exchange will work there

2: the response there is an object like

  {
    "events": [...],
    "totalCount": 3,
    "dateRange": {
      "startTime": "2026-04-01T00:00:00Z",
      "endTime": "2026-04-30T00:00:00Z"
    }
  }

So access the events array from that response.

[zhiganov]

Thanks @tompscanlan! Both fixes applied:

1. Event publishing switched to POST /api/events — commit
2. Calendar availability now unwraps { events: [...] } response shape

Will test both paths and report back. The busy-slots-in-date-range endpoint you mentioned would be great for the calendar overlay use case — happy to test whenever that's ready.

[zhiganov]

Fully working end-to-end now, @tompscanlan — thanks for your help earlier in the thread. Sample event just published: https://platform.openmeet.net/events/cibc-demo-day-v2-idhgrn

The pieces that took a bit longer to work out on our side:

1. ATProto OAuth scope caching — bsky caches grants per client_id with no prompt=consent, so existing users were never re-prompted for rpc:net.openmeet.auth after we added it. Fix was rotating the client-metadata URL so bsky treats it as a new app.
2. rpc scope syntax — the pinned form rpc:net.openmeet.auth?aud=did:web:api.openmeet.net was silently dropped from the consent grant (never displayed on the consent screen either). Switching to the wildcard rpc:net.openmeet.auth?aud=* — as your cross-app-authentication article recommends — is what got the scope into the grant.
3. CreateEventDto required fields — we were missing maxAttendees, categories, timeZone, and sending location as an object instead of a string. Added sane defaults and moved the poll URL to locationOnline.

Calendar availability (/api/external-calendar/events) also working — we fetch busy times and render them as a pink overlay on the grid while respondents pick availability.

Closing this issue on our side. If the "busy slots in a date range" endpoint you mentioned upstream ever materialises, happy to test.