What a Bluesky App Password Is and When You Need One

What is a Bluesky app password?

Third party Bluesky clients sign in with a Bluesky app password, a separate credential you generate in your account settings that authenticates as you while carrying less authority than your real password. AT Protocol's own specification describes app passwords as "a mechanism to reduce security risks when logging in to third-party clients and web applications," created and revoked separately from the primary password. Generate one per tool, so revoking one tool never disturbs the rest.

The generated value takes the form of four hyphen separated groups of four characters, such as 1234-abcd-5678-efgh, according to the same specification, which lets a client detect the format and warn a user who pastes it in place of a main password by mistake. Bluesky shows the value once at creation time, so copy it into the tool that needs it before moving on.

Why do third party tools ask for one instead of your password?

Third party tools ask for an app password because it grants "slightly restricted permissions to the client application," in the AT Protocol specification's own words, rather than the full authority of the main password. A session opened with the main password can do anything the account can do, while a session opened with an app password is explicitly blocked from destructive actions on the account itself. A tool that insists on your main password instead of an app password is asking for more access than the protocol expects it to need.

The practical effect is that a leaked app password is a contained incident. Whoever holds it can act as you within that restricted scope, but cannot take the account away from you, because the account level operations that would do that are blocked at the protocol level, not just hidden in a client's interface.

How do you create a Bluesky app password?

Create a Bluesky app password from your account settings, in the section dedicated to app passwords, by naming the new password and generating it. Name each one after the tool that will use it, since a settings page full of unlabeled entries makes revoking the right one harder months later. Bluesky displays the generated value once, so paste it into the waiting tool right away rather than closing the window first.

What can and cannot a Bluesky app password do?

An app password can log in and act as the account for ordinary use, and cannot perform the account level operations the AT Protocol specification reserves for the main password.

The specification is explicit that this restriction blocks "destructive actions like account [deletion] or changes to authentication settings (including app passwords themselves)," which is the line that keeps a compromised integration from locking the real owner out.

How do you revoke a Bluesky app password?

Revoke a Bluesky app password from the same app passwords section in account settings by deleting the entry for that specific credential. AT Protocol's server-side revocation removes an app password by name, so only the sessions created with that one password stop working, leaving the main password and every other app password untouched. Revoke a password immediately after you stop using the tool it belonged to, and first if you ever suspect one has leaked.

Where should you use a Bluesky app password?

Use a Bluesky app password anywhere you connect a bot, a scheduling tool, an analytics dashboard, or a monitoring service like RedReplier's Bluesky monitoring to your account. Any workflow that authenticates programmatically rather than through the official Bluesky app or website is the right place for an app password instead of the main one. Set up automation through the app password path from the start, since retrofitting it after a tool already has your main password means rotating that main password too.

If you are building automation that also needs to know which account a post came from, AT Protocol DIDs cover the permanent identifier behind the handle, and Bluesky search operators cover how to query posts once you are authenticated. Reading public posts is a separate question from acting as an account: a tool that only watches social listening signals across public Bluesky posts needs no credential of yours, while a tool that replies, follows or posts on your behalf does.

Frequently Asked Questions

Can I have more than one app password at a time?

Yes. Bluesky lets an account hold multiple app passwords at once, and AT Protocol's restriction on changing authentication settings applies to each of them individually, so one app password cannot revoke or alter another.

Does an app password expire automatically?

AT Protocol's specification does not describe an automatic expiration for app passwords; they remain valid until the account holder deletes them from settings. Revoke unused app passwords manually rather than assuming they expire on their own.

What format does a Bluesky app password use?

A Bluesky app password takes the xxxx-xxxx-xxxx-xxxx form, according to AT Protocol's own specification, which lets a client detect the format and flag a user who pastes their main password into the wrong field by mistake.

Can an app password delete my Bluesky account?

No. AT Protocol's specification explicitly excludes destructive actions like account deletion from what an app password session can do, reserving that action for a session created with the main account password.

Should I use an app password for a bot I built myself?

Yes. A self-built bot is still a third-party client from the account's perspective, and giving it an app password limits what a bug or a leaked credential in your own code can do to the account.

What should I do if I think an app password leaked?

Delete that specific app password from account settings immediately, then generate a new one for the tool that needs it. Because deleting an app password does not touch the main password or other app passwords, this stops the leak without disrupting anything else connected to the account.

Do I need a separate app password for every tool I connect?

Generating one app password per tool keeps a leak contained to that single integration. If you share one app password across several tools instead, revoking it to deal with one leaked or dropped tool logs out every other tool using it too.

Will revoking one app password log me out of everything?

It won't. AT Protocol's server-side revocation removes an app password by name, so only the sessions created with that specific credential stop working. The main password and every other app password keep functioning.

Can I sign into the official Bluesky app with an app password?

App passwords are built for third-party clients, bots, schedulers, and dashboards that authenticate programmatically rather than through the official Bluesky app or website. Automation is the right place for an app password; the official app and website are what the main password is for.

Why should I name each app password after the tool using it?

A named app password is easy to identify later, while a settings page full of unlabeled entries makes it hard to tell which one belongs to which tool. Clear names let you revoke the right credential quickly if a specific tool is dropped or compromised months later.