Skip to content

Get Bluesky posting credentials

Let keryx auth bluesky sign in and keryx publish post a text-and-image announcement to a Bluesky account. Bluesky has no app registration and no OAuth for this: you make an app password on the account and keryx uses it with your identifier (handle or email) to create a session per post (spec 0060 D9). Five minutes.

1. Make an app password

  1. In the Bluesky app or at https://bsky.app/settings/app-passwords, choose Add App Password.
  2. Name it (keryx is fine) and copy the generated password. It is shown once. It is not your account password, and it can be revoked on its own.

2. Sign keryx in

keryx auth bluesky

It prompts for the identifier and the app password, creates a session to prove they work, then stores the password in the OS keychain (else the accounts file, ~/.keryx/accounts.yaml, plaintext, never committed), records platforms.bluesky.identifier beside it, and sets platforms.bluesky.enabled in config. Nothing is printed back.

On a headless host, or in CI, set BLUESKY_APP_PASSWORD in the environment instead; the publisher reads it before the keychain and the file, and auth bluesky uses it in place of the prompt.

A self-hosted PDS is platforms.bluesky.service in the project's .keryx.yaml (default https://bsky.social).

3. What a post looks like there

  • Text with each hashtag made a tag, held to Bluesky's 300 graphemes (and 3000 bytes) together; approve measures the same body, and publish refuses rather than truncates. The link is not repeated in the body: the card below is the click target, and a canonical URL would take 55–80 of the 300. A link you write into the text yourself is made clickable there.
  • With a link: an external card (title, description, the post's image as its thumbnail when the file is under 1 MB; larger images post without a thumbnail).
  • Without a link: an image embed, up to four, with alt text. An image over 2 MB is refused.
  • No video: a reel cannot be sent to Bluesky, and its tab says so.

Refresh

An app password does not expire. keryx auth refresh validates it by creating a session and asks for re-auth if Bluesky rejects it (a revoked app password).