Connect Bluesky with OAuth,not an App Password
An App Password reads like a limited credential and is not one. It grants close to everything your account can do, it cannot be narrowed to posting, and deleting it cuts off every tool holding the same string. Here is what atproto OAuth changes, and how OpenTweet connects without asking you for a credential at all.
Last updated: September 2026
7-day free trial. Cancel anytime.
Why App Passwords exist at all
Bluesky issues no API keys and runs no developer program, so for a long time an App Password was the only way a third-party tool could act on your behalf. Generating one instead of sharing your real password was a genuine improvement, and it is where the improvement stops. atproto OAuth is the current model.What an App Password actually grants
Three properties, and each one is a surprise to somebody.
It is not scoped. There is no posting-only App Password. The credential authenticates as you and covers close to everything your account can do. A scheduling tool that only ever needs to create posts holds the same access as one that could rewrite your whole repository.
It is a bearer string, and it gets copied. Whatever you paste it into stores it and replays it. In a hosted tool that means a vendor database. In a self-hosted script or an MCP server it means plaintext in an env file or a JSON config in your home directory, readable by anything running as you, and a file that dotfile repos swallow routinely.
Revocation is all or nothing. You can delete it, and people will tell you that makes it fine. It does not, because almost nobody generates a separate App Password per tool. One string ends up in three or four places, and pulling it because you fell out with one vendor takes down the other three at the same moment.
The two models side by side
Both can be revoked, so revocation alone is not the argument. Scope and blast radius are.
| App Password | atproto OAuth | |
|---|---|---|
| Where you type your password | Into the vendor, or into a config file | On your own server, on a page the vendor does not control |
| What it is allowed to do | Close to everything your account can do | Only the scope the app asked for. For posting, that is posts and images |
| Removing one tool | Delete the string, breaking everything sharing it | Revoke that grant. Everything else keeps working |
| What a breach at the vendor exposes | A reusable credential for your whole account | A grant scoped to posting, revocable in one click |
| Accounts on a self-hosted server | Works only if the tool did not hardcode a host | Resolved from your handle, so any server works |
| Standing in atproto | The older model OAuth is replacing | The current auth model |
The self-hosting row is the practical tell. An integration built around App Passwords often assumes bsky.social, and OAuth cannot, because resolving your server from your handle is how the flow starts.
Where the tools stand
Checked September 2026. Look at the connect screen yourself before you paste anything.
Ask for an App Password
- Buffer
- Circleboom
- Nuelink
- Typefully
- Essentially every open-source Bluesky MCP server
This is not a claim that any of them are careless. It is the default the ecosystem inherited, and moving off it is work nobody has had a reason to prioritise.
Ask for nothing
- OpenTweet, over atproto OAuth
- You type a handle, not a credential
- You approve on your own server
- The grant covers posts and images
- Revoke it on its own, from either side
The connect screen has one field on it and that field is your handle. If you ever see a password box, you are on the wrong page.
One quick test for any tool: ask whether an account on a personal data server you run yourself can connect. An honest yes usually means OAuth, because a hardcoded host cannot answer it.
The connect flow, start to finish
Type your handle
yourname.bsky.social, or your own domain if that is your handle. That is the entire input. OpenTweet resolves which personal data server holds the account from the handle itself, so there is no server URL to look up and nothing to paste.
Approve on your own server
You are sent to your server to sign in and approve. That page belongs to Bluesky, or to whoever runs your server, not to OpenTweet. Your password is typed where it already lives and never travels anywhere else.
The grant covers posting, and only posting
The scope OpenTweet asks for creates posts and uploads images. It does not cover reading your DMs, changing who you follow, or touching the rest of your repository. There is no field anywhere in this flow for an App Password, because none is used.
Revoke it on its own whenever you want
Disconnect in OpenTweet, or revoke the grant on your server. Either way it is one grant going away. Nothing else you have connected to your Bluesky account is affected, which is the thing an App Password cannot give you.
Already pasted an App Password somewhere
Delete it in Bluesky settings under App Passwords, then reconnect the tools you still want over OAuth where they support it. Deleting revokes it everywhere at once, so do it when you have a few minutes rather than between meetings.What you get once it is connected
OpenTweet is X automation, and Bluesky is the mirror. The same draft, the same queue, the same calendar, and one result per network telling you what landed where. Write a post or a thread once, tick both networks, and each gets a native post rather than a copy with a link back.
Worth knowing before you rely on it. Bluesky stops at 300 characters while X allows 280, or 25,000 on Premium, so a long post is skipped on Bluesky with the reason recorded and still publishes on X. Up to 4 images at 2MB each, with alt text carried across. Video does not cross-post to Bluesky, and Bluesky analytics do not exist, so nothing reads engagement back from that side. The full workflow is here.
Frequently asked questions
Is it safe to give a third-party app my Bluesky App Password?
It depends on how much you trust the app, because an App Password is not scoped. It grants close to everything your account can do, not just posting. The safer question is whether the app supports atproto OAuth, because then the question of trust gets much smaller: the grant covers a defined set of actions and nothing else.
What is the difference between my Bluesky password and an App Password?
An App Password is a separate string you generate so you do not hand out your real password. That is a real improvement over sharing the main one, and it is where the protection stops. It is still close to full account access, it is still a bearer credential the app stores, and it is not limited to any particular action.
How do I revoke a Bluesky App Password?
Delete it in Bluesky settings, under App Passwords. The catch is scope: one App Password often ends up in several tools, and deleting it cuts off all of them at once. If you want to remove one tool cleanly, you needed a separate App Password per tool from the start, which almost nobody does.
Does Bluesky have an API key?
No. There is no API key, no developer program, and no application form. That absence is why App Passwords became the default in third-party tools: for a long time they were the only thing available. atproto OAuth is the current model and it replaces them.
What does atproto OAuth actually change?
Three things. You sign in on the server that holds your account rather than typing a credential into a vendor form, so the app never sees a password. The grant is scoped to what the app asked for. And you revoke that one grant without touching anything else you have connected.
Does OAuth work if I self-host my Bluesky account?
Yes, and this is the part App Password integrations often get wrong. OAuth resolves your personal data server from your handle, so an account on a server you run connects exactly like one on bsky.social. An integration that hardcoded a host will not.
Which social tools still ask for a Bluesky App Password?
Most of them, as of September 2026. Buffer, Circleboom, Nuelink and Typefully all take an App Password to connect a Bluesky account. Check the connect screen of any tool before you paste: if it has a field for a password, it is the older model.
What is OpenTweet allowed to do with my Bluesky account?
Create posts and upload images. The OAuth scope does not cover reading your DMs, changing who you follow, or the rest of your repository, and OpenTweet never sees your password or asks for an App Password.
Related
The scheduler this connection powers, the MCP config version of the same problem, and what it costs.
Bluesky scheduler
Scheduling posts and threads on the connection this page describes, with no API key anywhere.
Bluesky MCP server
The same argument where it bites hardest: an App Password sitting in claude_desktop_config.json.
Cross-post from X to Bluesky
What to do once the account is connected. One draft, both networks, one result per network.
Cross-posting, in full
What each network gets, the limits side by side, and what cross-posting deliberately does not cover.
What cross-posting costs
Bluesky charges nothing. X charges per post, and 13x that for a link. The whole bill is the X half.
Pricing
Three plans from $11.99 a month. Bluesky is on all of them.
Connect Bluesky without handing over a credential
Type your handle, approve on your own server, and the grant covers posting and nothing else. Included on every plan from $11.99 a month.