OAuth
Bluesky accounts authenticate with OAuth. The protocol-level OAuth documentation lives on atproto.com, and most developers should reach for an SDK that implements it rather than building a client by hand.
Getting started
- About OAuth — an overview of atproto OAuth, the available SDKs, and common app architectures (public vs. confidential clients, backend-for-frontend, etc.).
- Most languages have an SDK that handles OAuth — including DPoP, PKCE, PAR, and token refresh — for you. See the SDK list.
Implementing OAuth
- Hands-on tutorials: OAuth with Next.js, OAuth with Node, and OAuth with Go.
- Implementing a client without an SDK? OAuth Patterns covers DPoP, PKCE, PAR, token refresh, and session storage.
- The atproto OAuth specification is the authoritative reference for client metadata, client types, scopes, and the full authorization flow.
Bluesky's own OAuth permission sets are published under the bsky-lexicons.bsky.social identity, browsable on the network.
note
Applications with their own end-user login flow should implement OAuth. Single-purpose applications such as bots or command-line tools may use app password authentication instead.
For service-to-service authentication (inter-service JWTs), see Service Auth.