Mastodon
Connect to Mastodon instances to read and post toots, manage follows, and access the fediverse via OAuth.
Auth Model
User OAuth
Standard OAuth 2.0 authorization. A user grants consent and receives an access token. Authpipe handles refresh, rotation, and health monitoring automatically.
Connection Flow
// Get a valid credential — always fresh, zero latency const { credential } = await authpipe.getCredential({ provider: 'mastodon', tenantId: 'org_acme', userId: 'user_123', });
// Use the credential with the provider API const response = await fetch('https://api.example.com/data', { headers: { Authorization: `Bearer ${credential}` }, });
// Drop-in React component <ConnectButton provider="mastodon" onSuccess={(conn) => console.log('Connected!', conn)} />
Available Scopes
Permissions you can request when connecting to Mastodon.
read Read all your account's data
write Modify all your account's data
follow Modify account relationships
push Receive push notifications
profile Read only your account's profile information
read:accounts Read account information
read:blocks Read your block list
read:bookmarks Read your bookmarks
read:favourites Read your favourites
read:filters Read your filters
read:follows Read your follows
read:lists Read your lists
read:mutes Read your mute list
read:notifications Read your notifications
read:search Perform searches
read:statuses Read statuses
write:accounts Modify your account
write:blocks Manage your block list
write:bookmarks Manage your bookmarks
write:conversations Manage conversations
write:favourites Manage your favourites
write:filters Manage your filters
write:follows Manage your follows
write:lists Manage your lists
write:media Upload media attachments
write:mutes Manage your mute list
write:notifications Manage your notifications
write:reports Submit reports
write:statuses Publish and manage statuses
What Authpipe handles for Mastodon
OAuth Orchestration
PKCE, state validation, callback handling, and provider-specific quirks — all automatic.
Encrypted Vault
AES-256-GCM encryption with per-tenant key isolation. OAuth tokens, API keys, and webhook secrets — never exposed to the frontend.
Silent Refresh
Proactive token refresh before expiry. SDK returns from local cache with zero latency.
Health Monitoring
Scheduled checks detect revoked tokens and expired credentials before users notice.
More Social providers
Bluesky
Access the Bluesky social network and AT Protocol APIs using an app password.
Buffer
Schedule and publish social media posts via Buffer using OAuth authentication.
Manage pages, posts, and ad campaigns on Facebook with installation and user-level OAuth access.
Publish content, manage comments, and read insights on Instagram via Facebook OAuth.
Ready to connect Mastodon?
Get your first 100 connections free. Set up in minutes with our SDK.