The permission set

When you sign in to app.dids.lol, your server asks whether to grant lol.dids.sites.manage. This page is what that means.

What it grants

• Write access to two collections — lol.dids.sites.site and lol.dids.sites.tile. Creating, updating, and deleting records in those, and nothing else in your repository.
• Blob upload — so files can be uploaded to your own server and named by your records.
• A named list of control-plane methods — register, verify, domain and index status, list domains, release, validate, reindex, and the space methods.

That is the whole of it. Your posts, your profile, your follows, your other collections are not in scope and cannot be reached with this grant.

What it does not grant

It does not grant reading your private data, writing to any other collection, acting as you anywhere on the network, or seeing your email address. A stolen session cannot do anything the list above does not cover — which is the point of scoping it this narrowly rather than requesting a general grant.

Where the tokens live

They never reach the browser. The application's backend holds the access token, the refresh token, and the key they are bound to, encrypted inside a cookie set on app.dids.lol only, which page JavaScript cannot read. What the page sees is your DID, your handle, and a token that only proves the request came from the page itself.

This has a cost worth stating plainly: while the application's page is open, it can drive the operations above on your behalf. That is true of any application you sign into. What it cannot do is exceed them, hand a credential to anyone, or reach your repository outside the two collections.

Requesting it from your own tool

Ask for atproto include:lol.dids.sites.manage. Your server resolves the permission set from the network — it is a published record like the lexicons — and renders the consent screen from its description.

If you would rather not use a browser session at all, you do not have to. The control plane accepts inter-service authentication: mint a service token on your own server naming dids.lol as the audience and the method you are calling as its subject, and call dids.lol/xrpc directly. That is the path a command-line tool takes, and it is the same service layer the application reaches — the same operations, the same authorization, a different way of proving who you are.

Spaces

For a space, one extra thing happens with your session and nothing else: a sixty-second, single-use token addressed to that one space is minted on your server and handed over, and dids.lol exchanges it for a credential bound to its key. Your session is not stored, not forwarded, and not extended. See Spaces.