← All guides

App passwords and "Sign in with Bluesky", explained

Updated 2026-07-25

Sooner or later a Bluesky tool asks you to authorise it. There are two ways that happens, they are not equally safe, and it is worth thirty seconds to understand which one you are being offered.

App passwords: a second key to the same door

An app password is a secondary password you generate in Settings → Privacy and security → App passwords. It looks like abcd-efgh-ijkl-mnop. You give it to a tool instead of your real password.

What it gets you:

• You never hand over your actual account password.
• You can revoke a single app password without changing anything else.
• Each tool can have its own, so you know who to cut off.

What it does not get you:

• Scoping. An app password can do nearly everything your account can: post, follow, unfollow, like, edit your profile. There is no “read-only” app password. (Bluesky added an opt-in for direct-message access; everything else is included by default.)
• Expiry. It works until you revoke it.

So the rule is simple: only paste an app password into something you would trust to post as you, because that is exactly what you are authorising.

OAuth: the door with a lock you control

The AT Protocol now has proper OAuth, and it is what new apps should use. The flow will look familiar from every “Sign in with…” button: the app sends you to your own server, you approve, you come back signed in. The app never sees a password at all.

What changes in practice:

• Nothing to copy and paste. One button.
• Tokens, not passwords. The app gets a token that expires and is refreshed; a stolen database of tokens ages out, a stolen app password does not.
• Revocation that means something. You can see the app in your account settings and cut it off, without touching anything else.
• Requests are bound to a key. The protocol uses DPoP, which ties each request to a key held by the app, so a token intercepted in transit is not enough on its own.

Bluesky’s own guidance is that apps with an end-user login should use OAuth, and that app passwords remain acceptable for bots and command-line scripts. Expect the “paste an app password” step to disappear from good tools over the next year.

How to revoke access, either way

• App password: Settings → Privacy and security → App passwords → delete the one you gave out. The tool stops working immediately.
• OAuth: the same settings area lists authorised apps; revoke there.

Do this the moment you stop using a tool. It costs nothing and closes a door.

A short checklist before authorising anything

1. Does it explain what it will do? “Manage your follows” is a promise you can check. “Grow your account” is not.
2. Does it need to write at all? An analytics dashboard that only reads your graph does not need any credential — the AT Protocol serves the follow graph publicly. If a read-only tool asks for a password, ask why. (Blue Horizons' free analyzer works with no login for exactly this reason.)
3. Where does the credential live? Encrypted at rest is the minimum. Sent to a browser extension or a spreadsheet is a no.
4. Can you revoke it in one place? If the answer is “email us”, walk away.

The rule of thumb

Read-only? No credential should be needed at all. Acting on your behalf? Prefer OAuth, accept an app password from a tool you trust, and revoke it when you are done. Never, in any circumstance, your real account password — no legitimate third-party Bluesky tool will ever ask for it.