Bluesky - SocialAPI.AI

Available Bluesky is available to every account on every plan, with no access request. Authentication uses an app password rather than OAuth, so there is no authorization redirect and no developer app to register.

At a glance

Field	Value
Platform slug	`bluesky`
Auth type	App password
API	AT Protocol (XRPC)
Best for	A unified inbox and publishing for a Bluesky account, including direct messages with a privileged app password.

Capabilities

Feature	Supported	Notes
Posts	Yes	Create and delete. Published posts cannot be edited, see below
Comments	Yes	Read, reply, hide. Threads come back flattened, see below
Mentions	Yes	Read from the notification feed
DMs	Yes	Requires an app password created with direct messages enabled, see below
Reviews	No	Bluesky has no review model
Editing published posts	No	The AT Protocol has no update operation for a post record
Webhooks	No	No real-time delivery, poll the API instead

Connecting

Bluesky does not use OAuth. There is no authorization URL and no code exchange. You create an app password in your Bluesky account settings and pass your handle and the app password in metadata:

curl -X POST https://api.social-api.ai/v1/accounts/connect \
  -H "Authorization: Bearer $SOCAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "platform": "bluesky",
    "metadata": {
      "identifier": "yourhandle.bsky.social",
      "app_password": "xxxx-xxxx-xxxx-xxxx"
    }
  }'

Response (HTTP 201):

{
  "account_id": "acc_01HZ9X3Q4R5M6N7P8V2K0W1J",
  "platform": "bluesky",
  "username": "yourhandle.bsky.social",
  "display_name": "Your Name"
}

SocialAPI resolves your handle to its DID and PDS host, validates the app password by signing in, and stores the account. No redirect, no second call.

Creating an app password

Sign in to Bluesky in a browser and open Settings > App passwords.
Click Add app password and give it a name, for example socialapi.
If you want SocialAPI to read and send direct messages, tick Allow access to your direct messages before creating the password. This option can only be set at creation time: it cannot be added to an app password after the fact. If you skip it and later want DM access, you must create a second app password with the option enabled and reconnect with it.
Bluesky shows the password once. Copy it and paste it as metadata.app_password in the connect request above.

Two-factor accounts

If your account has email-based two-factor authentication enabled, the first sign-in attempt returns platform.bluesky.auth_factor_required and Bluesky emails you a confirmation code. Retry the connect request with that code as metadata.auth_factor_token.

Direct messages

DMs work only with an app password created with the direct messages option enabled. SocialAPI probes for that flag when you connect and remembers the answer. If the app password does not carry DM access, every DM call returns 403 with platform.bluesky.dm_scope_missing rather than an opaque 401 from Bluesky:

{
  "error": {
    "code": "platform.bluesky.dm_scope_missing",
    "message": "This app password does not have direct message access. Create a new app password in Bluesky settings with the direct messages option enabled, then reconnect."
  }
}

The account keeps working for posts, comments, and mentions: only the DM endpoints are affected. Because the flag cannot be added to an existing app password, the fix is to create a new one with the option ticked and reconnect, not to re-authorize.

Disconnecting

Disconnecting a Bluesky account through SocialAPI removes the stored credential from SocialAPI’s database, but it does not revoke the app password on Bluesky’s side: the AT Protocol has no app-password revocation API. To fully cut off access, delete the app password yourself in Settings > App passwords on Bluesky.

Known limitations

Posts cannot be edited after publishing. The AT Protocol has no update operation for a post record. To change a post, delete it and create a new one.
Comment threads come back flattened. Bluesky’s thread endpoint returns a tree with no pagination cursor, so SocialAPI flattens it into a single list rather than paging through it. Very large threads may be truncated.
You can hide a reply but not delete it. Hiding a reply to one of your posts updates your post’s moderation settings so the reply no longer shows by default. There is no way to delete a reply that another account posted; only that account can delete its own reply.
No real-time webhooks. Bluesky does not push events to SocialAPI. Poll the inbox and post endpoints for new comments, mentions, and messages.
Typing @handle in a post does not create a real mention. SocialAPI auto-detects links and hashtags in post text, but not mentions. An @handle in your post text publishes as plain text rather than a linked mention, so the mentioned account is not notified.

​At a glance

​Capabilities

​Connecting

​Creating an app password

​Two-factor accounts

​Direct messages

​Disconnecting

​Known limitations

​Related