Sooner or later a Bluesky tool asks you to authorise it. There are two ways that happens, they are not equally safe, and it is worth thirty seconds to understand which one you are being offered.
App passwords: a second key to the same door
An app password is a secondary password you generate in Settings → Privacy and
security → App passwords. It looks like abcd-efgh-ijkl-mnop. You give it to a
tool instead of your real password.
What it gets you:
- You never hand over your actual account password.
- You can revoke a single app password without changing anything else.
- Each tool can have its own, so you know who to cut off.
What it does not get you:
- Scoping. An app password can do nearly everything your account can: post, follow, unfollow, like, edit your profile. There is no “read-only” app password. (Bluesky added an opt-in for direct-message access; everything else is included by default.)
- Expiry. It works until you revoke it.
So the rule is simple: only paste an app password into something you would trust to post as you, because that is exactly what you are authorising.
OAuth: the door with a lock you control
The AT Protocol now has proper OAuth, and it is what new apps should use. The flow will look familiar from every “Sign in with…” button: the app sends you to your own server, you approve, you come back signed in. The app never sees a password at all.
What changes in practice:
OAuth uses expiring access tokens and refresh credentials, together with request-signing keys. Compromise of stored credentials can still allow account access: expiry alone is not a substitute for revocation. Review the permissions granted, revoke unused authorizations and keep the provider account secure.
Public profile and follow-graph reads can work without authentication. Private information, including your muted accounts, requires authorization even when the tool only reads it. OAuth permissions depend on the requested scopes; check the consent screen. App passwords remain an option for supported scripts and tools.
How to revoke access, either way
- App password: Settings → Privacy and security → App passwords → delete the one you gave out. The tool stops working immediately.
- OAuth: the same settings area lists authorised apps; revoke there.
Do this the moment you stop using a tool. It costs nothing and closes a door.
A short checklist before authorising anything
- Does it explain what it will do? “Manage your follows” is a promise you can check. “Grow your account” is not.
- Does it need to write at all? An analytics dashboard that only reads your graph does not need any credential, the AT Protocol serves the follow graph publicly. If a read-only tool asks for a password, ask why. (Blue Horizons' free analyzer works with no login for exactly this reason.)
- Where does the credential live? Encrypted at rest is the minimum. Sent to a browser extension or a spreadsheet is a no.
- Can you revoke it in one place? If the answer is “email us”, walk away.
What this tool does
Connect with Bluesky uses OAuth: approve access on your account’s server. Blue Horizons does not receive your main Bluesky password. Operators may have a separate installation sign-in, and an app-password connection can be available in supported installations. An app password is not the password requested by the administration sign-in. The public analyzer needs no sign-in.
The rule of thumb
Public profile and follow-graph reads can work without authentication. Private information, including your muted accounts, requires authorization even when the tool only reads it. OAuth permissions depend on the requested scopes; check the consent screen. App passwords remain an option for supported scripts and tools.
Blue Horizons applies shared application budgets and plan limits. Bluesky may impose additional limits, and activity in other clients also consumes network capacity. A larger plan does not guarantee that every action will succeed; review the result and any retry time.
Try it without connecting anything: analyze any handle.
Quick start: switch between your accounts
Basic and Pro connect one Bluesky account; Max connects up to five.
- Open the account menu and Your account. Choose Add another account when your plan has room.
- Enter the other handle and complete its authorization on its own server. Check which account you are authorizing.
- Use the account menu to switch between connected accounts. Before selecting people or running an action, check the active handle at the top.
Connecting accounts does not merge their followers or histories. Do not disconnect an account just to switch: disconnecting removes its stored data from Blue Horizons. Open the app or compare plans.