TL;DR: You can post to Bluesky automatically through its own AT Protocol API, and unlike Threads or X, nobody makes you clear an app review queue or pay per call to do it. The real cost is building and maintaining your own client: handling app-password auth, XRPC calls, and the fact that every post you send lands as permanently public data. For a single account, driving the browser session you already log into skips that build entirely.
Bluesky logged 1.41 billion posts in 2025 alone, 61% of everything ever posted on the network since launch, and crossed 30 million registered users along the way. That’s a real, active feed, not a ghost town people signed up to and forgot. Yet for a platform built on a genuinely open protocol, most of the people posting into it are still doing it one tab, one draft, at a time.
Bluesky’s API doesn’t gatekeep you, but it doesn’t do the work for you either
Start with the good news, because it’s a real contrast to how most other platforms treat developers. Bluesky’s own documentation is blunt about it: there’s no developer portal to apply to, no review queue, and no key Bluesky has to issue you before you can call the AT Protocol API. You create an account and start making requests. Compare that to Threads, where posting through the official API means registering a Meta developer app and clearing App Review for the publish permission, or X, which meters API access by pricing tier.
So why doesn’t everyone just script it themselves? Two reasons show up fast once you try.
First, auth isn’t full OAuth yet. Bluesky is rolling it out, but as of now, third-party tools authenticate with an app password: a 19-character throwaway credential in the format xxxx-xxxx-xxxx-xxxx, generated from Settings → Privacy and Security → App Passwords. It’s restricted from destructive actions like account deletion, which is good, but it’s still a secret you have to generate, store, and rotate per app, and pasting it into a random script is exactly the habit Bluesky’s own security writeups warn against.
Second, the rate limits are generous but not infinite. Per Bluesky’s own docs, each account gets 5,000 points per hour and 35,000 per day, with a single post creation costing 3 points. Do the math and you get roughly 1,666 posts an hour in theory, which nobody legitimate is going to hit. The limit that actually matters is the maintenance burden: keeping an XRPC client working against a protocol that’s still actively adding features, handling session refresh, and re-authenticating when an app password expires.
There’s a third thing worth knowing before you automate anything here, and it’s not a rate limit: Bluesky has no private accounts. A Bluesky maintainer has confirmed that the current version of AT Protocol only supports public content. Your posts, your profile, your likes: all public data, stored in a repository anyone can read, by design. Whatever an AI posts on your behalf here isn’t going anywhere quietly.
Let an AI run it through the session you’re already logged into
This is where PublishPort’s model gets you past the client-building work without touching Meta-style app review, because there isn’t one to get past on Bluesky’s side. An AI agent gets two tools: list_capabilities(), which returns a plain-language list of what it can do per platform, and local_bash(cmd), which runs the actual publish command through opencli, an open-source CLI that drives the browser session you’re already logged into.
The Bluesky adapter in publishport-opencli talks to AT Protocol’s XRPC endpoints directly, but it does that through your existing browser session instead of asking you to generate and hand over a separate app password. There’s no new credential to create for this specific tool, no rotation schedule to remember, and no client code to keep patched against protocol changes. It’s the same underlying approach covered in the fediverse trio piece on cross-posting to X, Threads, Bluesky, and Mastodon, just applied to one account instead of a matrix of them. The free desktop client is what a cloud AI connects to when it calls that command.
How to actually set it up
- Install the PublishPort desktop client and let it detect your machine’s browser profiles.
- Log into Bluesky normally in the same browser the client will use, so the session is already there when the AI reaches for it.
- Connect your AI agent to the client through its MCP endpoint, then have it call
list_capabilities()and confirm Bluesky shows up as postable. - Hand the agent a draft. It posts through the same authenticated session you’d use by hand, not a separate app password you have to manage.
- Check the first few posts land the way you expect before you trust the flow with anything time-sensitive.
Limits and what to keep in mind
None of this changes what Bluesky itself allows or what its rate limits cap you at. The 5,000-points-per-hour ceiling still applies whether a script or a person is posting, and duplicate or near-identical content across accounts reads the same to any spam filter regardless of who typed it. Keep the pace something an active human account would plausibly hit, and remember the public-data point from earlier: don’t automate anything into a public feed that you’d want to walk back quietly later, because on Bluesky, quietly isn’t really an option. Treat the browser session your AI is using like any other credential. If it leaks, whoever has it can post as you.
Bluesky auto-posting checklist
- Confirm whether you need Bluesky’s official AT Protocol API directly (multi-account SaaS, custom tooling) or just want your own account posting on autopilot
- If it’s the official API: generate an app password, budget time for building and maintaining your own XRPC client
- If it’s your own account: skip the client-building work and drive your existing logged-in session instead
- Respect the 5,000-points-per-hour, 35,000-per-day limits and Bluesky’s own spam rules
- Remember every post is public data on AT Protocol, there’s no private-account option to fall back on
- Never share your app password or session credentials outside the tool that needs them
FAQ
Does Bluesky have an API?
Yes. Bluesky runs on AT Protocol, which exposes a fully public API with no developer approval process and no per-call fee. You create an account and start calling it directly, a genuine contrast to platforms that gate publishing behind an app review queue.
Is the Bluesky API free?
Yes, there’s no published pricing tier for standard use. The friction isn’t cost, it’s the work of building and maintaining your own client against app-password auth and the platform’s evolving endpoints.
What are Bluesky’s rate limits for posting?
Each account gets 5,000 points per hour and 35,000 per day, and a single post costs 3 points, which works out to roughly 1,666 posts an hour in theory. In practice, the limit that trips people up first is Bluesky’s own spam and duplicate-content enforcement, not the point cap.
Can I make my Bluesky posts private?
No. AT Protocol currently supports public content only, and Bluesky’s own team has confirmed there are no private accounts. Posts, profiles, and likes are all stored as public data that anyone can read.
Do I need an app password to automate Bluesky?
If you’re calling the official API directly, yes: Bluesky requires a 19-character app password for third-party access since full OAuth is still rolling out. Tools that drive your existing logged-in browser session don’t require you to generate a separate one.
Will auto-posting to Bluesky get my account flagged?
The posting pattern is what triggers enforcement, not automation itself. Posting faster than a human plausibly would, or sending duplicate content across multiple accounts, is what Bluesky’s spam systems look for, whether a script or a person sent it.