[Feature Request] Extension/API passwords

[mobilex1122]

Add settings page where you can define app specific passwords so that apps/extensions that doesn't support OIDC login can still connect to Poznote.

I use Poznote in OIDC only mode and want to use the Chrome Extension with it but the only way to login is with password (which my instance doesn't have enabled) so I can't use the extension.

(Inspired by BlueSky App passwords)

[mobilex1122]

Note: It can also be made so that the extension will have an OIDC login option added.

[timothepoznanski]

Thanks for the suggestion, this is implemented and will ship in the next release.

You can now create app passwords from Settings > App passwords. Give one a name, optionally an expiry, and copy the secret it shows once. In the Chrome extension, enter your usual username and paste the app password in the password field. The extension needs no update: an app password travels as ordinary HTTP Basic Auth, so the same works for curl, scripts, the Android app and any other client.

They are deliberately weaker than your account password, which is what makes them safe to hand to an extension:

• they never open the web interface, so SSO stays the only way into Poznote itself
• they are refused on every /api/v1/admin/* endpoint, even when the account is an administrator
• they cannot change your password, edit or delete your account, or create further app passwords
• they are bound to the profile that created them, so X-User-ID cannot point them at another account
• they are accepted even when "Disable HTTP Basic Auth for API" is on, which from now on only blocks account passwords, so they work precisely on the instances that need them
• each one can be given an expiry and revoked at any moment, and the list shows when each was last used, so a credential nobody uses any more is easy to spot and remove

On your second point, adding an OIDC login to the extension: I went with app passwords instead. An OIDC flow inside an extension would mean every self-hoster registering the chrome-extension:// redirect URI in their own identity provider, handling refresh tokens, and configuring an API audience in Poznote, and it would still leave the Android app, curl and the MCP server without an answer. One revocable secret solves all of them at once.

Thanks again for this great suggestion! 😊