Skip to content
Schedule Social Media
SchedulersNetworksAPI changesGuidesToolsCompareFind your schedulerNews

Press Esc to close.
New feature Bluesky Severity: low

Bluesky PDS adds OAuth sign-up and an account page for revoking connected apps

Announced9 May 2025
EffectiveNot stated
PlatformBluesky

What changed

On May 9, 2025 the AT Protocol team described new web functionality in the reference PDS and on Bluesky's hosting service: users can create an account inside the OAuth flow, and an account page at /account (https://bsky.social/account for Bluesky-hosted accounts) lists authorized OAuth apps with Revoke access buttons and signed-in devices. It does not show password-based app sessions. The post also stressed that long-lived sessions are only possible with confidential OAuth clients. A June 24, 2026 update added password change, deactivation and deletion to the page.

What it means

Apps using OAuth can let new users create an account during login, and users can see and revoke connected OAuth apps at bsky.social/account, so tools should expect revoked sessions.

Who is affected

Developers of Bluesky tools that use OAuth login, and users who want to see or cut off apps connected to their account.

What to do

Handle revoked OAuth grants gracefully and prompt users to reconnect. For sessions that must last more than a few days or weeks, as scheduling tools need, use a confidential OAuth client.

What this means for you

Since May 2025 there is a web page, bsky.social/account for most people, where you can see which apps you have connected to your Bluesky account and cut any of them off. If a scheduling app stops posting, check that page: you may have removed its access, and you will need to connect it again.

The details

  • OAuth sign-up: a client can start an auth request to a specific PDS without knowing the user's account. The PDS offers "Create a new account", runs handle selection, terms and anti-abuse checks, then continues the authorization and redirects back to the app.
  • Account page: at /account on the PDS, for example https://bsky.social/account. It shows authorized OAuth applications with "Revoke access" and the devices signed in to the host. It "does not show password-based auth sessions to apps", so app passwords are still managed elsewhere. Sign-in there uses the full account password, not an app password.
  • Branding: on independent PDS hosts the flow is unbranded by default and can be customised with PDS_LOGO_URL, PDS_SERVICE_NAME and other settings.
  • Session length: "long-lived auth sessions (eg, more than a couple days or weeks before re-authentication) are only possible with 'confidential' clients", which need an app server holding private keys to sign token refreshes. See AT Protocol OAuth improvements for the session lifetimes announced a month later.
  • June 24, 2026 update: the page in reference PDS v0.4.5006 and on Bluesky's entryway also lets users change their password and deactivate or delete their account.

What to do next

  • Business owners: Visit bsky.social/account now and then to see which apps can post for you, and remove any you no longer use.
  • Marketers and agencies: If a client's scheduled Bluesky posts stop, check whether access was revoked and reconnect the account.
  • Developers: Detect revoked grants and ask the user to reconnect, and run a confidential OAuth client if your app posts on a schedule for weeks at a time.

Primary sources

Checked against the source 7 Nov 2026

Get an email when a new API change is added

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.