Mastodon

Tier

POST /api/v1/apps is a public endpoint that returns client credentials immediately, and the docs mention no app review or approval.

Using Composio?

Mastodon isn't in Composio's managed-auth catalog, managed or bring-your-own. Plan to register OAuth clients yourself on each Mastodon server.

Your account

Users see: The server's standard authorization page, showing your app name and requested scopesNext: Add per-server client registration so users on any server can connectDocs1, 3, 4

Any Mastodon server

Users see: The same authorization page on their own server. The docs describe no unverified-app warning.Docs3, 4

Mastodon has no scope review. Every scope is self-serve, but admin scopes only work for accounts with moderator or admin roles on that server.

• profile / read:* / write:* / pushbasicThe user's identity, plus reading and writing their data. Nothing. Available immediately.
• admin:read / admin:write (and granular admin:*)sensitiveModeration and admin APIs. No review, but only usable by staff accounts on that server

• 422 Redirect URI must be an absolute URI

  The redirect URI passed to /api/v1/apps is relative or malformed.

  FixRegister a full absolute URL, or urn:ietf:wg:oauth:2.0:oob for testing.

  Docs3, 7

• invalid_grant at token exchange

  The redirect_uri doesn't match the registered one, or the client_id belongs to a different server.

  FixUse the exact registered redirect URI and the credentials stored for that server's domain.

  Community7· medium confidence

• Discovery endpoint returns 404

  The server runs a Mastodon version before 4.3.0, which has no discovery endpoint and no PKCE.

  FixFall back to the plain authorization code flow without PKCE and register only scopes that server supports.

  Docs4, 2

• 429 Too Many Requests

  The default limit is 300 calls per 5 minutes per account and per IP. Media uploads are limited to 30 per 30 minutes.

  FixRespect the X-RateLimit headers and back off.

  Docs6

• Can individual server admins block or remove third-party apps, or restrict registration through /api/v1/apps?

  The official docs don't cover admin controls over third-party apps.

  ResolveCheck the server's rules or ask its admins. Test registration on the major servers your users are on.

• Is POST /api/v1/apps rate-limited by IP?

  The rate limits page doesn't list a separate limit for app registration.

  ResolveWatch the X-RateLimit headers when registering, and cache credentials so you register once per server.

• Do Mastodon-compatible servers (forks or other ActivityPub software) behave the same way?

  This research covered upstream Mastodon only.

  ResolveTest against each server type your users need.

1. 1Obtaining client app accessMastodon docs · Official docs · checked 27 Oct 2026
2. 2OAuth ScopesMastodon docs · Official docs · checked 27 Oct 2026
3. 3apps API methodsMastodon docs · Official docs · checked 27 Oct 2026
4. 4oauth API methodsMastodon docs · Official docs · checked 27 Oct 2026
5. 5Logging in with an accountMastodon docs · Official docs · checked 27 Oct 2026
6. 6Rate limitsMastodon docs · Official docs · checked 27 Oct 2026
7. 7oauth_dropins.mastodon sourceoauth-dropins docs · Search results · not yet checked
8. 8Managed auth toolkitsComposio docs · Composio docs · checked 27 Oct 2026