Last updated: September 2026
Do I have to give a scheduling tool my Bluesky password?
Never your account password. But most tools ask for the next thing down, an App Password, and that is not the modest permission it sounds like. It grants close to everything your account can do, and the only way to withdraw it is to delete it, which cuts off every tool you gave that same string to.
There is a third option that almost nobody markets: atproto OAuth, where you sign in on your own server and the tool receives a scoped grant instead of a credential.
App Password versus OAuth, line by line
Both get your posts published. They differ entirely in what you are exposed to between now and the day you stop using the tool.
Revocation is the row people skip
An API key can be rotated for one integration without disturbing the others. An App Password cannot. If the same string is in three schedulers and one of them has a breach, your only lever deletes the connection for all three, and you then go and re-authorize the two that were fine.Who asks for what
As of September 2026 this is close to unanimous. The commercial Bluesky schedulers ask for an App Password: Buffer, Circleboom, Nuelink and Typefully all take that route, and not one of them markets OAuth as a feature. That is not an accusation of carelessness, it is a description of where the tooling sits.
OpenTweet connects over atproto OAuth, so there is no password field and no App Password field anywhere in the flow. You type your handle, your own server shows you its sign-in screen, and OpenTweet keeps a scoped grant.
A test you can run on any tool in ten seconds
Start the connect flow and watch the address bar. OAuth sends you to your own server and back. If you never leave the tool and the form wants a string you generated in Bluesky settings, it is an App Password, whatever the button says.The same distinction is why a self-hosted account works in one case and not the other, which is covered in can I cross-post if I self-host my own PDS.
If you are stuck with an App Password anyway
Plenty of good tools only offer that path. Four rules keep the exposure bounded.
One App Password per tool
Revocation is all-or-nothing per password, so sharing one string across tools means you cannot cut off just the tool you stopped trusting.
Name it after the tool
Six months later the list is unreadable otherwise, and you will keep a password alive because you cannot remember what breaks if you delete it.
Delete it the day you stop
A trial you abandoned still holds a live credential with close to full account access until you go and remove it.
Never reuse your account password
It is the one string that can change the account itself. No legitimate tool needs it, and being asked for it is where the conversation should end.
What the OAuth version looks like in practice
You connect the account once in the dashboard. After that, publishing is a call with a bearer key that belongs to OpenTweet, not to Bluesky, and that key you can rotate on its own whenever you like.
# No Bluesky credential anywhere in this request.
curl -X POST https://opentweet.io/api/v1/posts \
-H "Authorization: Bearer ot_your_key" \
-H "Content-Type: application/json" \
-d '{
"text": "Shipped without pasting a password into anything.",
"platforms": ["x", "bluesky"],
"publish_now": true
}'Bluesky allows 300 graphemes, up to 4 images at 2MB each with alt text, and threads. Video does not publish there, and there are no Bluesky analytics, because nothing reads engagement back. A post that overruns 300 is skipped on Bluesky with the reason recorded and still publishes wherever it fits. The endpoint reference is in the cross-posting docs.
7-day free trial. Cancel anytime.
Frequently asked questions
Do I have to give a scheduling tool my Bluesky password?
You should never hand over your main account password, and no reputable tool asks for it. What most of them do ask for is an App Password, which is a different string but not a small permission: it grants close to everything your account can do. There is a third option, atproto OAuth, where you sign in on your own server and the tool never receives a credential at all.
What can a Bluesky App Password actually do?
Close to everything your account can do. It is not scoped to posting the way an API key would be. That is the reason to treat it as a credential rather than as a key, and to keep one per tool so that the blast radius of a leak or a shutdown is one tool wide.
How do I revoke a Bluesky App Password?
By deleting it in your Bluesky settings. There is no per-tool revoke and no scope you can narrow after the fact. If you pasted the same App Password into three schedulers, deleting it cuts off all three at once, which is why a separate one per tool matters.
Which Bluesky schedulers use OAuth instead?
Very few. As of September 2026 the common commercial schedulers, Buffer, Circleboom, Nuelink and Typefully among them, ask for an App Password, and none of them market OAuth as a feature. OpenTweet connects over atproto OAuth, so no password of any kind is pasted into it.
How can I tell if a tool is using OAuth or an App Password?
Watch where you type. With OAuth you enter only your handle, the tool sends you to your own server, and you sign in there. If the sign-in form lives inside the tool and asks for a string you generated in Bluesky settings, that is an App Password no matter what the page calls it.
Does OpenTweet store my Bluesky credentials?
No. You sign in on the server that holds your account and OpenTweet keeps a scoped OAuth grant rather than a credential. You can revoke that grant on your own server, or disconnect inside OpenTweet, and neither action touches any other tool you use.
Keep exploring
The auth question, the cost question, and where a Bluesky mirror fits next to X.
Bluesky scheduler
Schedule Bluesky posts and threads over atproto OAuth, with no credential to paste.
Is there a Bluesky API key?
No, and nothing to apply for. What you authorize instead of a key.
Does it work with a self-hosted PDS?
Yes, and OAuth is the reason. Handle resolution beats a hardcoded host.
Why is the Zapier Bluesky action gated?
The app is Premium, so the free plan cannot run it. What to do instead.
Cross-posting to X and Bluesky
One draft, a native post on each network, and a per-network result you can read.
Is connecting an MCP server safe?
The same question on the X side: what a connection grants and what to check.
No password. No App Password. Just a grant you can revoke.
atproto OAuth for Bluesky, one-click for X, and one draft that publishes natively to both. Flat $11.99 a month.
7-day free trial. Cancel anytime.