Skip to content

Get Bluesky posting credentials

Let keryx auth bluesky sign in and keryx publish post a text-and-image announcement to a Bluesky account. Bluesky has no app registration and no OAuth for this: you make an app password on the account and keryx uses it with your identifier (handle or email) to create a session per post (spec 0060 D9). Five minutes.

1. Make an app password

  1. In the Bluesky app or at https://bsky.app/settings/app-passwords, choose Add App Password.
  2. Name it (keryx is fine) and copy the generated password. It is shown once. It is not your account password, and it can be revoked on its own.

2. Sign keryx in

keryx auth bluesky

It prompts for the identifier and the app password, creates a session to prove they work, then stores the password in the OS keychain (else the accounts file, ~/.keryx/accounts.yaml, plaintext, never committed), records platforms.bluesky.identifier beside it, and sets platforms.bluesky.enabled in config. Nothing is printed back.

On a headless host, or in CI, set BLUESKY_APP_PASSWORD in the environment instead; the publisher reads it before the keychain and the file, and auth bluesky uses it in place of the prompt.

A self-hosted PDS is platforms.bluesky.service in the project's .keryx.yaml (default https://bsky.social).

3. What a post looks like there

  • Text, with the link appended and made clickable, and each hashtag made a tag. The whole thing is held to Bluesky's 300 graphemes (and 3000 bytes); the composer is told the cap includes the link and tags, and publish refuses a post that would exceed it rather than truncating.
  • With a link: an external card (title, description, the post's image as its thumbnail when the file is under 1 MB; larger images post without a thumbnail).
  • Without a link: an image embed, up to four, with alt text. An image over 2 MB is refused.
  • No video: a reel cannot be sent to Bluesky, and its tab says so.

Refresh

An app password does not expire. keryx auth refresh validates it by creating a session and asks for re-auth if Bluesky rejects it (a revoked app password).