Bluesky API

Yes. Posting to Bluesky through the API has no fee, no paid tier and no app review. You log in as the account, get a session token and write records. The limits are rate limits, counted in points, not dollars.

That makes Bluesky the network where going direct is most reasonable. If Bluesky is the only network you post to, the raw API below is a fine choice. A unified API helps when you post to Bluesky alongside X and LinkedIn, as in crossposting.

Two calls. com.atproto.server.createSession exchanges a handle and app password for an access JWT; com.atproto.repo.createRecord writes the post to the app.bsky.feed.post collection. Each post needs text and createdAt, and the response returns the record's uri and cid.

These are Bluesky's own quick-start examples. $PDSHOST is https://bsky.social for most accounts, or the account's own PDS if it's self-hosted.

curl -X POST $PDSHOST/xrpc/com.atproto.server.createSession \
  -H "Content-Type: application/json" \
  -d '{"identifier": "'"$BLUESKY_HANDLE"'", "password": "'"$BLUESKY_PASSWORD"'"}'

curl -X POST $PDSHOST/xrpc/com.atproto.repo.createRecord \
  -H "Authorization: Bearer $ACCESS_JWT" \
  -H "Content-Type: application/json" \
  -d "{\"repo\": \"$BLUESKY_HANDLE\", \"collection\": \"app.bsky.feed.post\", \"record\": {\"text\": \"Hello world! I posted this via the API.\", \"createdAt\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}}"

Writes are metered in points per account: creating a record costs 3, updating 2, deleting 1, within 5,000 points an hour and 35,000 a day. That works out to about 1,666 new posts an hour or 11,666 a day, far above anything a well-behaved bot needs.

The limit that bites is logins. createSession allows 30 calls per 5 minutes and 300 per day per account, so a script that logs in before every post will hit it. Store the session and refresh it; we resume a saved session and only log in again with the app password when the session is rejected.

Bluesky's docs say these limits are aimed at bots that follow or like at bulk scale, and that moderation and app-specific limits may apply on top. Our own fair-use cap is 300 posts per Bluesky account per 24 hours.

Bluesky's lexicon limits post text to 300 graphemes and 3,000 bytes. A grapheme is what a reader sees as one character: a family emoji is several code points but one grapheme, so it counts as 1.

JavaScript's .length counts UTF-16 code units and gets this wrong; Intl.Segmenter gets it right. The 3,000-byte cap rarely matters in English but can in scripts with multi-byte characters or emoji-heavy posts; our preflight checks both limits. Our Bluesky character counter counts the way Bluesky does, and the Bluesky character limit page has the detail.

Bluesky won't turn https://... in text into a link on its own. The client sends a facet: a byteStart and byteEnd into the UTF-8 encoded text, plus a feature saying what the range is. The lexicon defines three features: link, mention and tag.

Mentions need the handle resolved to a DID with com.atproto.identity.resolveHandle; Bluesky's docs say to leave it as plain text if the handle doesn't resolve. Offsets are bytes, not characters, so any emoji before the link shifts them.

Through SocialsForAI, links, mentions and hashtags get facets automatically. Link preview cards are a separate app.bsky.embed.external embed that the client must fetch and upload itself; we don't generate link cards yet, so links are clickable but show no preview.

{
  "$type": "app.bsky.feed.post",
  "text": "Read the docs: https://example.com/docs",
  "createdAt": "2026-11-01T15:04:05Z",
  "langs": ["en"],
  "facets": [
    {
      "index": { "byteStart": 15, "byteEnd": 39 },
      "features": [{ "$type": "app.bsky.richtext.facet#link", "uri": "https://example.com/docs" }]
    }
  ]
}

Upload each file with com.atproto.repo.uploadBlob, then reference the returned blob in an app.bsky.embed.images embed with alt text and, if you know it, aspectRatio. Bluesky's docs advise leaving aspectRatio out rather than guessing.

The lexicon allows 4 images of up to 2,000,000 bytes each. Bluesky's prose guide still mentions 1 MB in one place while its sample code checks 2 MB; the lexicon is the authority. We download each image from your public URL and return media_too_large if it's over 2 MB.

Bluesky's quick start says apps with end-user login should use OAuth, and that bots and command-line tools can stick with passwords. In every password case it says to use an app password rather than the main account password.

Our connect page uses app passwords today: the account owner creates one in Bluesky's settings, enters it on our hosted page, and we store it encrypted. It can be revoked in Bluesky without changing the main password. Accounts on a self-hosted PDS work too; enter the PDS URL on the connect page.

Each Bluesky failure maps to one of our error codes, with a fix and a retry decision:

• 401 or AuthenticationRequired: account_needs_reauth. The app password was revoked; create a new one and reconnect with a connect link.
• 429: platform_rate_limited, retried at 30s, 2m, 10m, 30m and 2h.
• 400: platform_rejected, not retried; the message carries Bluesky's reason.
• Other failures: platform_unavailable, retried.
• Over 300 graphemes or 3,000 UTF-8 bytes: text_too_long at preflight, before any call to Bluesky.

Send text and image URLs to POST /v1/posts. We count graphemes, build facets, upload blobs, write the record, then read it back with getPosts so verified: true in the response means the post exists. For agents, the Bluesky MCP server exposes the same call as a tool.

curl https://socialsforai.vercel.app/v1/posts \
  -H "Authorization: Bearer $SOCIALS_API_KEY" \
  -H "Idempotency-Key: launch-0412" \
  -d '{
    "accounts": ["acc_bluesky", "acc_linkedin", "acc_x"],
    "text": "We just shipped webhooks.",
    "wait": true
  }'