Pixelfed uses OAuth 2.0 for API clients, but the instance administrator can disable the feature. On 2026-11-04, ZoomEye returned 727 matches for title="Pixelfed" and zero for app="Pixelfed" with page 1, page size 1 and sub_type=all. The title result is a candidate list. It does not identify which instances are active, which are public and which have OAuth enabled.
The API route is conditional
Pixelfed's authentication documentation says OAuth can be turned off, and the API documentation describes the authorization-code flow for enabled deployments. Registration endpoints and invite links can also be disabled, returning a not-found response. A 404 is therefore a policy result, not necessarily a broken route.
For owned instances, record the intended state of OAuth, registration and invitations. Test each path from outside the administrative network. Confirm that a disabled feature cannot be re-enabled by a direct API call and that the login page does not reveal an obsolete client secret.
Photo libraries need a separate data path
Authentication protects the client API, while media URLs and public profiles may use different access rules. Review the public profile, individual post, collection and direct-message paths separately. A public photo can be intentional. A private account's media should not become available through an old share URL, cache or thumbnail endpoint.
Use an owned test account and test media rather than inspecting third-party private content. Check whether account deletion and block actions revoke access tokens and remove background jobs. The account-settings API documentation describes token deletion during account deletion, which is useful evidence but not a substitute for an operational test.
Why the app field is empty
The zero app count may reflect missing fingerprint coverage, a title that comes from client-rendered HTML or a proxy that changes headers. It does not justify assuming that every title match is a Pixelfed server. The 727 title matches are candidates for domain and certificate grouping, not a vulnerability population.
The public profile is not the administration panel. Review the admin domain, OAuth configuration and shared storage separately. If the instance uses a separate admin domain, check the DNS ownership and TLS certificate names as part of the same deployment.
A bounded checklist
Confirm the public domain and instance ownership.
Record whether OAuth, registration and invitations are expected to be enabled.
Test a disabled endpoint and document the response.
Review token revocation, account deletion and session behavior.
Verify private media and direct messages reject anonymous access.
ZoomEye provides the outside candidate set. Pixelfed's API documentation provides the expected authentication behavior. The useful conclusion is conditional: a public profile or title does not tell an observer whether OAuth is enabled or whether private media is protected.
References
[1] Pixelfed API authentication