Default flow (dynamic registration) When a user connects, goals.ac POSTs to `{instance}/api/v1/apps` to register an OAuth client, then redirects to `{instance}/oauth/authorize`.
Redirect URI used: `{NEXTAUTH_URL}/api/auth/mastodon/callback`
No global env vars required Mastodon credentials are stored per project after authorization.
Restricted instances If an instance disables open registration:
- 1
Manually create an app in the instance's Preferences → Development
- 2
Set redirect URI to match goals.ac callback
- 3
Scopes: `read write:statuses`
Manual client_id/secret fallback in the product UI is planned; today users should use instances that allow dynamic registration (most public instances do).
Mastodon 4.3+ App registration persistence improved in recent versions. Older instances may require a client-credentials token after registration to prevent app cleanup.