Don't Give Your Main Bluesky Password to 3rd-Party Apps

If you are reading this blog post, you are most likely familiar with the Bluesky social network. If not, there are plenty of other blog posts that can get you up to speed. But, assuming you are, you ended up here, because you’ve wanted to try one of the hundreds of 3rd-party apps out there that use Bluesky, and were, frankly, put off when you saw it asking for your credentials.

I mean, a password? Really? Like, hell no, I’m not giving my password to a 3rd-party application that promises to keep it safe! Hell, no!

But the truth is, you probably have. Or, if not you, someone else has because the temptation to use the app was bigger than anyone’s privacy concerns.

Bluesky has started rolling out OAuth recently, but it’s a work in progress, and 3rd-party apps out there still insist on having your password, so what do you do?

The Solution #

Luckily, there is a simple way to comply with those apps and still keep your account (relatively) secure. It’s called an App Password, and you can have as many of those as you need. I wish Bluesky were more vocal about those.

Creating one is pretty much like creating an API token - if you are on bsky.social, you can click this link right here. Follow the steps below, and you will get a brand new password that’s just as good as your main one. The good thing is that you can have plenty of those, and each one can be revoked at any time, without this affecting any of your other passwords (or your main one). The bad thing is that those are still passwords, and anyone who has them can log into your account and manipulate it. It’s better than nothing, but I am still hoping for a more robust long-term solution.