Bluesky

Overview

Provider id bluesky. The provider authenticates against the hosted entryway https://bsky.social, creates a session, and publishes one text record. The body is the shared content.text and there are no per-target publish options.

Requirements

A Bluesky account and an app password for it. An app password cannot create or delete other app passwords.
Syndroo 0.7.0 installed on Node.js 24.19.0 or newer.
The account handle in the identifier field.

UNRESOLVED. Two official Bluesky pages give different settings paths for creating an app password (one names Privacy and Security, the other names Advanced). This guide therefore does not print a menu path. Confirm it in your own account before you write instructions for anyone else.

Credentials

Field	Meaning	Secret
`identifier`	Your handle, for example `you.bsky.social`.	No
`password`	The app password, not the account password.	Yes

The session response carries both did and handle. Syndroo stores the did as the account identity because a handle can change.

Connect

export SYNDROO_CREDENTIALS='{"identifier":"you.bsky.social","password":"APP_PASSWORD_PLACEHOLDER"}'
syndroo connect bluesky --from-env --label work

The credentials are validated against the provider's own schema before anything is stored. The session token that comes back is stored in the local credential store; the environment variable is not needed again for publishing.

First publish

{
  "type": "prepare",
  "content": { "text": "Syndroo publishes from the command line." },
  "targets": [{ "provider": "bluesky" }]
}

syndroo publish --input post.json --json
syndroo publish --input - --json < execute.json

One call creates the record. A successful delivery reports the record URI as the remote id; a client-side timeout after the record committed is an unknown outcome and stays non-retryable.

Capabilities

The manifest declares exactly one capability, text. The post lexicon caps the text at 3000 bytes and 300 graphemes, and the provider enforces that before sending.

Options

Where	Accepted keys
Connect options	None. The provider reads only the credential fields.
Publish options	None. Unknown keys are refused rather than ignored.
Content	`text`, required.

Troubleshooting

Bluesky answers XRPC calls with a JSON error carrying an error name; a returned name such as ExpiredToken, InvalidToken or AccountTakedown classifies the response in hand only. It is not evidence about an earlier write, and a generic 400 or 5xx is never proof that a timed-out write did not apply.

UNRESOLVED. Whether the PDS rejects an oversized ingest body is not documented on the sources used here.

Revoke and security

Delete the app password in your account settings to revoke the credential that Syndroo stored, then remove the local connection. Disconnecting in Syndroo only removes the local record; it never revokes a platform credential for you.

syndroo connect --disconnect <connectionId>