Bluesky
Connect Bluesky to OpenQuok with an app password — schedule text, images, video, and follow-up replies.
Connect your agent today
Draft from chat, review in your calendar, and publish only what you approve.
Overview
Bluesky publishing uses your handle or email, an app password, and the service URL of your account host (default https://bsky.social). There is no operator-registered developer app and no backend env vars for this channel. OpenQuok encrypts those credentials on the server so workers can publish on your behalf.
CLI walkthroughs: CLI Examples — Bluesky.
Dashboard connect only
Add Bluesky Channel in the workspace. GET /api/v1/public/social/bluesky returns 400 — there is no public OAuth start URL for this channel.
How OpenQuok stores your credentials
OpenQuok needs a reversible copy of your app password and service details to log in at publish time (one-way hashing is not an option for publishing).
| Layer | What happens |
|---|---|
| Browser | You enter service URL, handle, and app password once in Add Channel. The values are not kept in localStorage or other client storage. |
| HTTP APIs | List, connect, and public integration responses omit token fields — the browser never reads the password back. |
| Database | Encrypted JSON with service, identifier, and password is stored as AES-GCM ciphertext on the connected channel (when INTEGRATIONS_TOKEN_ENCRYPTION_KEY or SECURITY_SECRET is set). OpenQuok re-validates credentials on refresh; it does not persist short-lived session tokens as the durable secret. |
The service URL must be public HTTPS only. OpenQuok rejects private, loopback, and link-local hosts (including DNS that resolves there).
Treat the app password as a secret
Anyone with the app password can post as that Bluesky account. Revoke it in Bluesky settings if it leaks, then reconnect the channel in OpenQuok.
Features
Supported
| Feature | Details |
|---|---|
| Connect | App password from Bluesky settings (works with two-factor authentication enabled) |
| Caption | Plain text up to 300 graphemes; text-only posts are valid |
| Media | Up to four images or one MP4 per post — never mixed |
| Alt text | Taken from media details when you set it in the composer |
| Links and mentions | @handle and URLs become rich-text facets at publish time |
| Follow-up replies | Same-account replies after the main post, with optional media on reply rows |
| Mentions | Composer autocomplete searches actors and inserts @handle |
Not supported
| Feature | Notes |
|---|---|
| Operator OAuth app | No OpenQuok env keys; users paste credentials in the dashboard |
| Public OAuth connect | Dashboard only |
| Workspace or per-post analytics | Not available in OpenQuok for Bluesky today |
| Extra compose Settings fields | No title, tags, or privacy panel beyond follow-up comments |
Create an app password
Open Bluesky settings
Sign in to Bluesky and open Settings → App passwords.
Generate an app password
Create a new app password. Copy it once — OpenQuok keeps it on the server for publishing after you paste it (see How OpenQuok stores your credentials).
Tip
You can keep two-factor authentication enabled. Use an app password here — not your main account password.
Connect in OpenQuok
In the workspace, choose Add Channel → Bluesky. The form prefills Service with https://bsky.social. Enter your handle or email and the app password, then connect. OpenQuok validates the credentials against your host, then saves the channel.
To refresh an existing channel, open the same credentials form (Refresh connection on Home) — do not expect a platform OAuth redirect.
Media and thread rules
| Rule | Detail |
|---|---|
| Images | Up to 4 per main post or follow-up row |
| Video | 1 MP4 per post — not combined with images |
| Length | 300 graphemes per caption and per follow-up message when scheduling |
| Follow-ups | Configure in Follow-up comments — stored under bluesky.replies for API and CLI |
See Media rules and Threads and comments.
Self-host
Bluesky needs no operator OAuth pair. Leave the social-app ID/secret rows in infra/self-host/.env.example unchanged. Users paste credentials in the dashboard after the stack is up. See Self-host — Docker Compose.