How to create a Bluesky app password

What an app password is

An app password is a second password you generate inside Bluesky and hand to one piece of software. It logs that software in to your account without ever revealing the password you type yourself.

Two things make it safer than sharing your real password. First, it is limited: Bluesky blocks app passwords from destructive actions such as deleting your account, and from creating further app passwords or viewing your invite codes. Second, it is disposable — you can revoke a single app password at any time, and everything else, including your own login, carries on working.

Make one per tool. If you ever want to cut a tool off, or you stop using it, you revoke that one password and nothing else is disturbed.

Creating one, step by step

1. Open Bluesky’s settingsIn the app or on the website, go to Settings from the menu.
2. Find App PasswordsIt sits under Privacy and Security in current versions of the app. Older versions listed it under Advanced, so if your menu looks different, check there.
3. Add an app passwordChoose Add App Password. Bluesky generates it for you — you don’t invent one.
4. Name it after the toolGive it a name you’ll recognise months from now, such as the name of the app you’re connecting. The name is how you’ll identify which one to revoke later.
5. Copy it immediatelyBluesky shows the password once. Copy it before you close the dialog; if you lose it, delete that one and generate another.
6. Paste it into the toolAlong with your handle — the one that looks like name.bsky.social, without the @.

In Bloom, this happens on the Setup screen: enter your handle, paste the app password, then press Test to confirm the connection before you schedule anything.

What an app password can and can’t do

An app password can do most of what you can do: read your timeline, post, reply, like and follow. That is the point — a scheduling tool has to be able to post as you.

It cannot delete your account, create more app passwords, or show your invite codes. So a tool holding an app password cannot lock you out or quietly give itself more access. What it can do is post, which is why you should only give one to software you actually intend to post with.

How to revoke an app password

Go back to the same App Passwords screen in Bluesky’s settings. Each password is listed by the name you gave it, with the option to remove it. Removing it takes effect straight away: the tool holding it is signed out and can no longer post.

Revoke one when you stop using a tool, when you no longer want it posting for you, or any time you are unsure. It costs nothing — if you change your mind, generate a new one and paste it back in. Your own login and every other connected tool are unaffected.

When it doesn’t work

• “Invalid identifier or password.” Usually the handle. Enter it without the @, and include the full domain — name.bsky.social, or your own domain if you use one.
• A stray space. Copying from a phone often picks up a trailing space. Retype or re-paste carefully.
• You pasted your main password. Some tools accept it and then fail later. Generate a real app password and, if you did paste your main one anywhere, change it.
• You revoked it and forgot. If posting suddenly stops with an authentication error, check whether the password is still listed in Bluesky’s settings.
• Two-factor prompts. App passwords are designed to bypass the interactive sign-in, so if a tool asks you for a code, it is asking for the wrong kind of login.

A few habits worth keeping

Treat an app password like a key you had cut: one per tool, labelled, and taken back when the tool leaves your life. Don’t paste one into a chat, an email or a shared document. Never give a tool your main Bluesky password, and be wary of anything that asks for it — a tool that cannot work with an app password is either badly built or not what it claims to be.

Bloom stores your app password encrypted and uses it only to post what you scheduled. You can disconnect Bluesky in Bloom at any time, and revoke the password in Bluesky as well — doing both is the thorough version.

Frequently asked questions