What Is a Bluesky App Password? 16 Characters, Three Scopes, and One Checkbox You Can't Undo
A Bluesky app password is a throwaway credential you generate for one app so it never sees your real password. It is 16 random characters, displayed as four dash-separated groups. It is not, however, a low-privilege key: Bluesky's own developer docs say app passwords "have most of the same abilities as the user's account password," and the only things they're blocked from are deleting your account, migrating it to another server, and creating more app passwords. The one real permission dial is a single checkbox for direct-message access — and it can only be set when the password is created.
An app password is a full-power credential with three things carved out of it, not a restricted one with a few things added in.
The guides ranking for this all get you to the button and stop. They also contradict each other on the most basic detail: blueskyfeeds calls it "19 character alphanumeric," several others call it a "16-character code," and konzentrik's guide tells you to "leave the checkbox unchecked" without ever saying what the checkbox does. (Both lengths are half right, which is how you can tell nobody counted.)
So I read the code that generates them. Everything below is checked against the atproto lexicons, the reference PDS implementation, and the Bluesky app's own source, on September 16, 2026.
How Do You Create a Bluesky App Password?
Settings → Privacy and Security → App Passwords, or bsky.app/settings/app-passwords if you want to skip the menu. Then:
- Tap "Add App Password."
- Name it after the tool. The app enforces three rules on the name: at least 4 characters, unique among your existing app passwords, and only letters, numbers, spaces, hyphens and underscores. The name is the only thing you'll ever see again, so "Buffer" beats "test2."
- Decide on DM access now. The checkbox reads "Allow access to your direct messages." More on why this is the irreversible step in a moment.
- Copy the password. It appears once. There is no "show again" — it's stored as a scrypt hash salted with your DID, so Bluesky genuinely cannot display it back to you.
- Paste it into the tool with your handle (your email works as the identifier too — the server lowercases whatever you give it and treats anything containing an
@as an email).
The generated password is 16 characters drawn from a 32-symbol alphabet, which works out to 80 bits of entropy — comfortably beyond guessing. The four groups of four are cosmetic, but the dashes are part of the string.
What Can a Bluesky App Password Actually Do?
Nearly everything. This is the part the how-to guides skip, and it's the part worth knowing before you paste one into a tool you found yesterday:
| Action | App password | Notes |
|---|---|---|
| Post, reply, like, repost, delete posts | Yes | Full write access to your repo |
| Follow, unfollow, block, mute | Yes | Including bulk, at API speed |
| Edit your profile, avatar, banner | Yes | |
| Read and send direct messages | Only if the box was ticked | Fixed at creation time |
| Change your password or email | No | |
| Delete or migrate your account | No | "Restricted from destructive actions" |
| Create another app password | No |
Underneath, that table is three access levels, and they have names. Bluesky's server tags every session with one of these scopes:
| Scope | What holds it | DM endpoints |
|---|---|---|
com.atproto.access |
Your real account password | Yes |
com.atproto.appPassPrivileged |
App password with DM access | Yes |
com.atproto.appPass |
App password without it | No |
That bottom row is the single most common support question I get, so: a plain app password fails on chat.bsky.convo.* with InvalidToken: Bad token scope, not with a login error. The tool connects fine, looks connected, and then silently can't message anyone. If a tool that sends welcome DMs is quietly doing nothing, that's almost always why — and it's why Bluesky DMs are worth understanding separately from the rest of the API.
And the checkbox cannot be changed afterwards. There is no update endpoint — the protocol has exactly three app-password methods, createAppPassword, listAppPasswords and revokeAppPassword, and privileged is only ever written by the first one. A password created without DM access will never have DM access. Delete it and make a new one; there is no other path.
One more asymmetry worth knowing if you use Bluesky's OAuth anywhere: you can't create an app password from an OAuth session. The server rejects it outright with OAuth credentials are not supported for this endpoint. To mint an app password you must be logged in with your real password.
Why Is My Bluesky App Password Not Working?
Four causes, roughly in order of how often they're the real one:
- You mistyped it, in a specific and predictable way. The alphabet is base32 — lowercase
a–zplus the digits2–7. There is no0,1,8or9in any app password, and no capital letters. So if you're squinting at what looks like a zero, it's the lettero; a "1" is anl; an "8" is ab; a "9" is ag. (Check it against any published example — the sample password in konzentrik's guide uses nothing but lowercase letters and the digits 3 and 6.) Also: keep the dashes. They're part of the password. - It's the DM scope, not the password. See the scope table above.
Bad token scopemeans the credential is valid and the permission isn't. - It was deleted. Deleting an app password revokes it immediately and everywhere — every tool holding it drops at once. And because deletion happens by name, two app passwords sharing a name are a bad idea.
- You're rate limited from retrying. The reference server caps session creation at 30 attempts per 5 minutes and 300 per day, keyed on the identifier plus your IP. If you've been pasting variants for ten minutes, stop for five — this is the same class of wall as a Bluesky rate limit exceeded error elsewhere in the API.
There's a fifth thing that isn't a fix but is worth knowing: Bluesky never records when an app password was last used. The list endpoint returns name, creation date and the privileged flag, and that is all. You cannot audit which of your app passwords is live. The only honest hygiene is to name them properly and delete anything you don't recognise, which costs you nothing but a reconnect.
Should You Use a Bluesky App Password or Bluesky OAuth?
OAuth, where the tool offers it. Bluesky shipped OAuth for the protocol on September 25, 2024 and was unusually direct about the direction of travel, telling developers to "stop using the legacy App Password system for new projects" and describing OAuth as "replacing the current flow using App Passwords and createSession over time." Two years on, app passwords still work fine — but they are explicitly the legacy path.
The practical differences:
| App password | Bluesky OAuth | |
|---|---|---|
| Tool receives | A long-lived credential it stores | A token it can't use elsewhere |
| You type your real password | Never (that's the point) | Never — you log in on Bluesky's own page |
| DM access | Create-time checkbox, unchangeable | Included |
| Revoking | Delete the app password | Revoke the session |
| Status | Legacy, still supported | The direction Bluesky is going |
This is the one place I have skin in the game, so take the pitch accordingly: Agent Sky accepts both, and we default to OAuth precisely because of the checkbox problem above — welcome DMs just work, and we never handle a password of yours at all. If you'd rather use an app password, tick the DM box when you make it. Beyond that we do the ordinary thing an automation tool on Bluesky is allowed to do: follow accounts genuinely active in your niche on a paced schedule, and verify a live follow-back before unfollowing anyone. $9 a month, free to start.
Whatever tool you connect, the rule that actually protects you is the boring one: one app password per tool, named after the tool, deleted the day you stop using it. A shared app password is a credential you can't revoke without breaking three things at once.
Quick FAQ
What is a Bluesky app password? A Bluesky app password is a separate credential you generate for one third-party app, so that app never sees your real password. It is 16 random characters shown as four dash-separated groups (xxxx-xxxx-xxxx-xxxx, 19 characters including the dashes), and it can do almost everything your account password can — post, follow, unfollow, block, mute, edit your profile. Bluesky's own developer documentation puts it plainly: app passwords "have most of the same abilities as the user's account password," minus account deletion, account migration, and creating further app passwords.
How do I get a Bluesky app password? Go to Settings → Privacy and Security → App Passwords, or bsky.app/settings/app-passwords directly, and tap Add App Password. Name it after the tool you're connecting — the name must be at least 4 characters, unique among your app passwords, and made only of letters, numbers, spaces, hyphens and underscores. If the tool sends direct messages for you, tick "Allow access to your direct messages" before you generate it. Bluesky shows the password once. Copy it then, because it is stored hashed and no screen will ever show it again.
Why is my Bluesky app password not working? Four causes, in the order they actually happen: a transcription error (the alphabet is lowercase a–z plus the digits 2–7 only, so a character that looks like 0, 1, 8 or 9 is really the letter o, l, b or g); a missing DM scope, which produces "Bad token scope" on the chat endpoints rather than a login failure; a password that was deleted on the Bluesky side, which revokes it instantly and everywhere; or login rate limiting, since the reference server allows 30 session attempts per five minutes and 300 per day per identifier and IP. Note that dashes are part of the password — don't strip them.
How do I find a Bluesky app password I already created? You can't, and this is by design. The list endpoint (com.atproto.server.listAppPasswords) returns only each password's name, creation date and whether it has DM access — never the password itself, which is stored as a salted scrypt hash. There is also no "last used" field anywhere, so you cannot tell which of your app passwords a tool is still using. If you lost one, delete it and create a replacement; the old one stops working the moment you delete it.