Bluesky app passwords: what they are and how to use them safely

If you've connected a scheduling tool, analytics service, or cross-posting app to Bluesky, you've probably been asked for an app password. It looks like a security hoop, and it is one — a good one. This guide explains what app passwords are, how to create and revoke them, and how to use them sensibly.

What an app password is

An app password is a separate password you generate in Bluesky for one specific app. It lets that app sign in as you and post, but it is not your main password:

• It's random. Bluesky generates it in the form xxxx-xxxx-xxxx-xxxx, so it can't be guessed or reused from another site.
• It's limited. An app password can't be used to change your main password or email, or to delete your account.
• It's revocable. You can delete one app password, cutting off that single app, without affecting anything else.
• Direct messages are opt-in. By default an app password can't read or send your DMs; you have to tick that box explicitly when creating it.

Many sites let third-party apps connect with OAuth instead, where you approve access on the platform's own page. Where an app connects to Bluesky with an app password, the app password is the safe way to do it. Never give any app your main Bluesky password.

Creating an app password

1. In Bluesky, open Settings.
2. Go to Privacy and security → App passwords.
3. Choose Add App Password.
4. Give it a name that identifies the app, such as "CreatorFlow" or "Scheduler – laptop". You'll want this when deciding what to revoke later.
5. Leave Allow access to your direct messages unticked unless the app genuinely needs your DMs. A scheduling or posting tool does not.
6. Copy the password and paste it into the app. Bluesky shows it only once; if you lose it, delete it and create a new one.

When the app asks for your handle, use your full handle (for example yourname.bsky.social, or your custom domain if you use one).

Revoking one

Go back to Settings → Privacy and security → App passwords and delete the password for the app you want to cut off. That app loses access the next time it tries to use it. Every other app keeps working.

Revoke an app password when:

• you stop using the app;
• you suspect the app or your device was compromised;
• you're unsure which app a password belongs to (a reason to name them clearly).

Good habits

• One app password per app. Never reuse one app password across tools. If one leaks, you can revoke it without breaking the others.
• Name them clearly. "App 1" and "test" are impossible to audit six months later.
• Review the list occasionally. Delete anything you don't recognise or no longer use.
• Keep DM access off by default. Grant it only when a tool's purpose clearly requires it.
• Turn on two-factor authentication for your main account. App passwords protect you from apps; 2FA protects your main login.

What a responsible app does with it

A well-built app stores your app password encrypted, uses it only to act on your instructions (such as publishing a post you scheduled), and never shows it back to you or anyone else. It should also let you disconnect Bluesky from inside the app, deleting the stored password.

That is how CreatorFlow handles it: when you connect Bluesky, the app password is encrypted with Google Cloud Key Management Service, decrypted only on our servers at the moment a post is published, and deleted when you disconnect. You can read more in our privacy policy, and the platform setup docs walk through connecting each network.