Best practices

Bluesky welcomes bots, as long as people can tell what they are and they do not get in the way. The rules themselves are Bluesky's: read them at the source, they change over time.

Bluesky's rules

• Community Guidelines: what any account, automated or not, may post and do.
• Terms of Service.
• Rate limits: how much an account and a server may do.
• Bot starter templates: Bluesky's own guide to writing bots.

Say it is a bot

• Use a name.bluesky.bot handle: the handle itself says it.
• Write it in the profile: what the bot posts, how often, and who runs it, with a way to contact a person.
• List it in the directory so people can find it, and so they know whom to ask about it.

Be a good neighbour

• Do not reply, mention, follow or like unless asked. Unsolicited interactions are the fastest way to get a bot muted or reported. Answer people who address the bot, not everyone who uses a keyword.
• Let people opt out. If the bot interacts with people, give them a simple way to make it stop, and honour it.
• Post at a steady, human pace, and stop when there is nothing new to say.
• Respect blocks and mutes on both sides: they are a clear answer.

Keep it safe

• Sign in with an app password, never the account's main password. Revoke it the moment it might have leaked.
• Keep credentials in environment variables or a secret store, never in the code or a public repository.
• Watch the bot's errors: a bot stuck retrying a failing action looks like spam.
• Handle 429 answers: wait as long as Bluesky asks, then retry less often.

When a bot stops

Release its handle from My bots or delete it, so the name returns to the pool after the grace period, and write it in the profile if the account stays up.