# Is it safe to give a scheduler your Bluesky app password? > Yes, if it's an app password & not your main one. Here's what it can & can't do, how to revoke it, & how DunSocial handles it. - Published: 2026-10-10 - Last updated: 2026-10-10 - Author: Sanju (Founder & CEO @ DunSocial) - Topics: bluesky, how-to --- Yes, as long as it is an app password & never your main Bluesky password. An app password is a separate credential you create in Bluesky settings, you can have several, & you can delete any one of them at any time. Bluesky has no built-in scheduling, so any scheduler that posts for you needs some way into your account. For most tools today, that way is an app password. ## What an app password can & can't do Bluesky's own ecosystem docs describe an app password as having most of the same abilities as your account password. It is restricted from destructive actions like account deletion or account migration, & it can't create more app passwords. That means it is not a read-only key. A tool holding one can post as you, so treat it like a credential, not a harmless token. The upside is control. Because you create one per tool, you decide who has access, & deleting it cuts that tool off without changing your main password. ## App password vs OAuth Bluesky's developers have said OAuth is expected to become the primary way apps sign in, replacing app passwords over time, & they encourage new projects to stop using the legacy app password system. With OAuth you approve an app on a Bluesky sign-in screen & it never receives a password of any kind. Until a tool supports that flow, an app password is the practical route, & it still keeps your main password out of the tool. Whichever method a tool uses, the rule is the same: never type your main account password into a third-party app. ## How to connect safely 1. Open [Bluesky's app password settings](https://bsky.app/settings/app-passwords) & create a new one named after the tool. 2. Do not enable the direct message access option unless the tool genuinely needs it. A scheduler only needs to publish. 3. Paste it into the tool once, along with your handle. 4. Keep a short list of which tool holds which app password, so cleanup is easy later. If a connect attempt fails, check that you pasted the app password (four groups of characters separated by dashes), not your normal password, & that the handle is spelled correctly. ## How to revoke access Delete that tool's app password in Bluesky settings. The connection stops working immediately & nothing else you have connected is affected. Deleting the wrong one is the most common reason a scheduled Bluesky post fails. If a post fails right after a settings cleanup, create a fresh app password & reconnect. The full checklist is in [why did my scheduled social post fail](/blog/why-did-my-scheduled-social-post-fail). ## How DunSocial handles your app password DunSocial uses your app password once, to open a Bluesky session. What it stores afterwards are the encrypted session tokens, not the app password itself, & it refreshes them on a schedule so the connection stays alive. Only workspace members with permission to manage social accounts can connect Bluesky. If a connection ever needs attention, the `social_account.reconnect_required` webhook can tell your own systems the moment it happens. For what scheduling to Bluesky looks like day to day, read [the best Bluesky scheduler in 2026](/blog/best-social-media-scheduler-for-bluesky). To post the same idea to several networks, see [how to cross-post to X, Threads & Bluesky](/blog/cross-post-to-x-threads-and-bluesky). ## Connect Bluesky to DunSocial $20/mo flat, or $192/yr, with a 14-day trial & every feature unlocked from day one. Connect Bluesky with a dedicated app password, schedule alongside your other networks, & confirm each post before it goes out. [Start the trial](https://app.dunsocial.com/login). ## FAQ ### Can a scheduler see my main Bluesky password? Not if you connect with an app password. You paste a separate credential that you created for that one tool, so your main password never leaves your hands. Never enter your main password into a scheduler. ### Should I use one app password for several tools? No. Create one per tool & name it. If you stop using a tool or distrust it, you can delete only its app password & every other connection keeps working. ### What happens if I delete the app password? The scheduler loses access straight away. Posts already queued for Bluesky will fail until you create a new app password & reconnect the account. ### Is an app password enough to delete my account? No. Bluesky's docs say app passwords are restricted from destructive actions such as account deletion & account migration, & from creating additional app passwords. ### Will Bluesky switch scheduling tools to OAuth? Bluesky's developers say OAuth is expected to become the primary sign-in method over time. App passwords still work today, so check your tool's connect screen when you set it up. ## Sources - [OAuth for AT Protocol (Bluesky developer blog)](https://docs.bsky.app/blog/oauth-atproto) - [App passwords (AT Protocol ecosystem docs)](https://github.com/bluesky-social/atproto-ecosystem/blob/main/app-passwords.md) --- ## About this document This is the Markdown representation of https://www.dunsocial.com/blog/is-it-safe-to-give-a-scheduler-your-bluesky-app-password. The HTML version of the same page is at the same URL. You can also request Markdown from any page by sending `Accept: text/markdown`. Machine-readable summary of the whole site: https://www.dunsocial.com/llms.txt ## Company - Product: DunSocial, https://www.dunsocial.com - Legal entity: THISUX PRIVATE LIMITED, Chennai, Tamil Nadu, India - Support: support@dunsocial.com - Open the app: https://app.dunsocial.com/login