···275275 return false;
276276 }
277277278278+ // For API calls, use the actual PDS endpoint
279279+ // But when we need to do token refresh, use bsky.social for auth on third-party servers
280280+ let authServer = pdsEndpoint;
281281+ if (!pdsEndpoint.includes('bsky.social')) {
282282+ console.log('[AUTH CHECK] Will use bsky.social for OAuth on third-party PDS');
283283+ authServer = 'https://bsky.social';
284284+ }
285285+278286 // First check if the token is expired by decoding it
279287 const tokenExpired = isTokenExpired(accessToken);
280288 if (tokenExpired && refreshToken) {
···306314307315 // For API calls, use the actual PDS endpoint
308316 const baseUrl = `${pdsEndpoint}/xrpc`;
309309-310310- // But when we need to do token refresh, use bsky.social for auth on third-party servers
311311- let authServer = pdsEndpoint;
312312- if (!pdsEndpoint.includes('bsky.social')) {
313313- console.log('[AUTH CHECK] Will use bsky.social for OAuth on third-party PDS');
314314- authServer = 'https://bsky.social';
315315- }
316317317318 // First, get the user's handle from their DID using repo.describeRepo
318319 const describeRepoEndpoint = `${baseUrl}/com.atproto.repo.describeRepo`;
···393394394395 try {
395396 // Try to refresh the token with enhanced error handling
396396- // Use authServer for token refresh (bsky.social for third-party PDS)
397397+ // Use bsky.social for token refresh with third-party PDS
398398+ let refreshAuthServer = pdsEndpoint;
399399+ if (!pdsEndpoint.includes('bsky.social')) {
400400+ console.log('[AUTH CHECK] Using bsky.social for token refresh with third-party PDS');
401401+ refreshAuthServer = 'https://bsky.social';
402402+ }
403403+397404 const { accessToken: newAccessToken, refreshToken: newRefreshToken, dpopNonce: newNonce } =
398398- await refreshAccessToken(refreshToken, keyPair, authServer);
405405+ await refreshAccessToken(refreshToken, keyPair, refreshAuthServer);
399406400407 // Update tokens in localStorage
401408 if (typeof localStorage !== 'undefined') {