@darius sigh, of course CORS gets in the way https://github.com/mastodon/mastodon/issues/10400
of like, crawling posts which are publicly visible and so shouldn't need any authentication.
(i'm also bummed out to learn that mastodon doesn't allow api token access to the as resources, only to its proprietary api. as resources need digest signed requests, which of course you can't do unless you're the server which holds the signing key of a recipient.)
@jleedev I wouldn't want to crawl public posts anyway. I would want to auth the app with a user which would allow blocks to be respected (even on public posts)