Bluesky is the easiest platform in PostHub to connect — there is no developer app to register, no OAuth consent screen, and no callback URL. You generate a small password inside Bluesky's settings and paste it in. Two fields, done.

The reason it works this way is that Bluesky has a first-class concept for exactly this: the app password.

What an app password actually is

An app password is a separate, revocable password that lets an app sign in and post without ever seeing your real Bluesky password. It carries the same powers as your login (so posting works), with three differences that matter:

1. 1You can kill it independently. Delete the app password and PostHub loses access instantly — your real password never changed, your other sessions are untouched.
2. 2It never exposes your main credentials. PostHub only ever holds this one string, encrypted at rest.
3. 3It is easy to recognise. App passwords are formatted as four short groups — xxxx-xxxx-xxxx-xxxx — so you can spot one in a list at a glance.

So the whole job is: make one, paste it, done.

Step 1 — open the App Passwords page

Direct link (fastest):

[https://bsky.app/settings/app-passwords](https://bsky.app/settings/app-passwords)

Or by hand:

1. 1Sign in at bsky.app.
2. 2Click your avatar (bottom-left) → Settings.
3. 3Open Privacy and security.
4. 4Choose App passwords.

Step 2 — create the password

1. 1Click Create app password.
2. 2Give it a name you will recognise later — PostHub is perfect. (The name is only a label; it does not change what the password can do.)
3. 3Bluesky shows the generated password once, formatted like abcd-efgh-ijkl-mnop.
4. 4Copy it. It will not be shown again — if you lose it, just create another.

No confirmation of your main password is required, and two-factor (if you use it) is not prompted — the app password is the credential.

Step 3 — connect in PostHub

1. 1In PostHub, open Connected Accounts.
2. 2Find Bluesky and press Connect.
3. 3Fill in the two fields: - Handle — your Bluesky handle without the @, e.g. yourname.bsky.social. Your DID (did:plc:…) also works if you prefer it. - App password — paste the xxxx-xxxx-xxxx-xxxx string from step 2.
4. 4Optionally pick a group (workspace folder) for this account.
5. 5Press Connect.

PostHub signs in with the handle + app password, reads your profile (avatar, follower count), and saves the connection encrypted. Your real Bluesky password is never typed into PostHub at all.

Step 4 — publish a test

Create a post in the composer, select the Bluesky account, and publish. The post should appear on your profile within seconds, complete with images and links.

Revoking access

Whenever you want PostHub to lose access — you are done with the trial, you suspect the password leaked, you simply want a clean slate:

1. 1Return to [bsky.app/settings/app-passwords](https://bsky.app/settings/app-passwords).
2. 2Find PostHub in the list.
3. 3Click the X / Delete next to it.

That is it — PostHub's stored password stops working immediately. Publishing will fail with an authentication error until you reconnect with a fresh app password (Connected Accounts → Bluesky → Connect). The account row stays where it is; only the credential dies.

Rotating is the same flow: delete, create new, reconnect. Thirty seconds.

Troubleshooting

"Invalid password" or auth failed on connect — the string was copied incompletely (app passwords must be pasted whole, dashes included) or it was revoked. Create a fresh one and paste it again.

Handle not found — the handle must be exactly what appears in your Bluesky profile URL, without @: name.bsky.social, not @name.bsky.social and not the email you signed up with. If you use a custom domain handle, paste it fully — yourdomain.com.

Posts start failing after working fine — the app password was deleted or Bluesky rotated something. Revoke-and-reconnect (above) fixes it.

"Rate limited" — Bluesky throttles brand-new accounts and bursts of identical posts. Wait a few minutes and retry; this is Bluesky-side, nothing in PostHub is broken.

Which PDS? — PostHub signs in against bsky.social, the default network. If you self-host your PDS this guide still applies, but the connection is created against the main network entry point.

Quick reference

| Thing | Where | | --- | --- | | Create an app password | bsky.app/settings/app-passwords | | What to paste in "Handle" | yourname.bsky.social (no @) | | What to paste in "App password" | the xxxx-xxxx-xxxx-xxxx string | | Revoke | same settings page → delete the PostHub entry | | Reconnect after revoke | Connected Accounts → Bluesky → Connect |

That is the whole integration: one revocable password, two fields, and a green card in Connected Accounts — with the ability to cut PostHub off from your Bluesky account at any moment, yourself, in one click.