Why one credential per client matters
A third-party Bluesky client is a separate piece of software that signs in to your account. If you hand it your main password, every client shares one secret and one blast radius. An app password narrows that exposure: it is a distinct credential you can retire without changing the password you use everywhere else.
Bluesky’s official ecosystem documentation recommends app passwords instead of the main account password for compatible third-party clients. Source
That recommendation is about credential hygiene, not about trust in any particular client. The same official documentation also sets a hard boundary you should know before you rely on an app password as a safety net.
App passwords have broad account abilities but are restricted from destructive actions such as account deletion or migration and from creating further app passwords. Source
So an app password is not read-only. It can act broadly on your account, but it cannot delete or migrate the account, and it cannot mint more app passwords. Plan your inventory around that asymmetry.
Client-to-credential inventory
Build the table before you revoke anything. List every client you recognise, the credential it uses, and what depends on it.
| Client or tool | Credential in use | Still needed? | Retirement step |
|---|---|---|---|
| Mobile or desktop client | Dedicated app password | Yes / No | Revoke in official settings after sign-out |
| Scheduling or cross-posting tool | Dedicated app password | Yes / No | Disconnect the tool, then revoke |
| One-off experiment | App password you cannot identify | Usually No | Revoke the matching entry |
| Unknown entry | Unclear | Investigate first | Match by creation date and label |
Two rules keep the table honest. First, one client should map to one app password; if two tools share a credential, you cannot retire one without breaking the other. Second, a connected client is not evidence of another public account. A tool authorised to post does not create a second identity, and a public profile match elsewhere is a lead, not proof of ownership.
Retirement checklist
- Open the official account settings and review the list of app passwords and connected access.
- Match each entry to a client using the label and the date you created it, not guesswork.
- Sign out of the client first, then revoke its app password, so the tool does not retry with a stale credential.
- Keep your main password and a recovery method you control until you have confirmed the client no longer has access.
- Re-check the list after a week; an entry you cannot explain deserves revocation.
Do not assume revocation deletes data the client already stored, and do not treat disconnecting a login as account deletion. If you are mapping older accounts more broadly, the guide to finding forgotten online accounts covers the inventory habit; our methodology explains how we describe tool limits.
Where a username check fits
Credential review answers “who can act as me.” A separate question is “what public handles are associated with me.” TraceSeek checks a username across 3,000+ platforms in 20-30 seconds, with a free first scan and no registration required for it. Results are public matches, not proof of ownership, and the app does not change platform settings or reveal private information. Use it to list your own known handles, then review each one in its own official settings.
Key facts
- Bluesky’s official ecosystem documentation recommends app passwords instead of the main account password for compatible third-party clients.
- App passwords have broad account abilities but are restricted from destructive actions such as account deletion or migration.
- App passwords cannot be used to create further app passwords.
- TraceSeek checks a username across 3,000+ platforms in 20-30 seconds, with a free first scan.