Is Automation Allowed on Bluesky? What the Rules Actually Say
Yes, with conditions. Bluesky moderates spam rather than automation itself. Where the line sits, the published rate limits, and an interactive safety checklist.
Short answer: yes, automation is allowed on Bluesky, and the network was built expecting it. Feed generators, labelers, and openly automated accounts are part of the AT Protocol's design. What Bluesky moderates is spam, platform manipulation, and inauthentic behavior. An automated account that behaves respectfully sits comfortably inside the rules. An account that bulk-follows strangers at machine speed does not, whether a human or a script pressed the button.
- Automation itself is permitted on Bluesky. Deceptive and spammy behavior is what gets moderated.
- The three behaviors that draw flags are bulk following, robotic timing, and follow-unfollow churn.
- Bluesky's published write limits allow roughly 1,666 creates per hour. Safe growth tools use under 1% of that.
- 20 to 75 follows per day with natural timing keeps most accounts in a healthy range.
What Bluesky's rules actually say
The Bluesky community guidelines are written around outcomes for people: no spam, no deceptive identities, no artificial amplification. There is no clause that bans software from acting on your behalf. That is deliberate. The AT Protocol publishes open APIs, and the network depends on automated services for feeds, moderation labels, and archiving. Automation is infrastructure here, which is a real difference from networks that treat every script as an intruder.
The second signal is how Bluesky handles account access. It ships official OAuth specifically so tools can act with your permission, under scopes you grant, without ever seeing your password. You can revoke that grant from Bluesky's settings at any moment. Any tool that asks for your actual password has put itself outside the intended model before it makes a single request.
The three behaviors that get accounts flagged
Moderation systems and human reviewers look at patterns, and three patterns account for most enforcement against growth-focused accounts.
- Bulk following. Hundreds of follows land in a burst with no filtering and no relationship to what the account posts. This is the classic spam signature, and it is visible to anyone who opens the account's following list.
- Robotic timing. Actions fire at perfectly even intervals, around the clock, including hours when the human behind the account has never once posted. Nothing about the pattern looks alive.
- Churn. Follow, wait, unfollow, refollow. Treating people as counters is precisely the inauthentic engagement the guidelines describe, and it burns goodwill with the very audience you wanted.
Notice that none of these require software. Manual growth hustlers earn flags the same way. Automation simply makes the mistakes cheaper to commit at scale, which is why the tool you choose matters as much as the strategy you set.
- Filter every candidate for relevance before following
- Spread actions across the hours you are actually online
- Hold a steady daily cap you could sustain by hand
- Keep people who engaged with you, even without a follow-back
- Use official OAuth and revoke access for tools you stop using
- Follow hundreds of accounts in a single burst
- Run 24/7 with metronome timing
- Unfollow people a day or two after following them
- Chase raw follower counts with unfiltered mass follows
- Hand any tool your account password
Bluesky's rate limits, in numbers
Bluesky enforces write limits at the PDS level with a points system. When the limits launched in 2023, the developer documentation set them at 5,000 points per hour and 35,000 points per day per account. Creates cost 3 points, updates cost 2, and deletes cost 1. A follow is a create, so the theoretical ceiling works out to roughly 1,666 follows per hour.
| Action | Points cost | Theoretical ceiling |
|---|---|---|
| Create (follow, post, like) | 3 points | ~1,666/hour · ~11,666/day |
| Update (profile edits) | 2 points | ~2,500/hour |
| Delete (unfollow) | 1 point | ~5,000/hour |
Rate limits describe what the server will accept, and moderation reads patterns long before you reach them. A tool using even 5% of these ceilings still looks nothing like a person. SkyFollowing campaigns default to 30 follows per day, well under 1% of the daily write ceiling, and even the highest plan cap stays near 2%.
What safe pacing looks like in practice
A person follows in small clusters, at irregular moments, during their waking hours, and takes days off. Safe automation reproduces that shape: a daily cap in the 20 to 75 range, actions spread across a defined active-hours window, natural jitter between actions, and volume that scales with account history. New accounts need a slower ramp; the week-by-week warmup schedule covers that in detail.
Eight yes-or-no questions. Anything you cannot check is worth fixing before you scale volume.
Most of the spam signature is still present. Fix the unchecked items before adding any volume.
How SkyFollowing stays inside the line
SkyFollowing ships with every rule above already applied. Relevance scoring is on for each new campaign, daily caps are hard limits that adapt to each account's age and health, actions carry jitter inside your active hours, and engagement-aware cleanup keeps anyone who liked or replied to you. A live ban-risk score watches every connected account and pauses campaigns on its own when something looks unusual.
Frequently asked questions
Can Bluesky tell that I am using automation?
Assume yes. Follows, timing, and churn are all visible in public network data, and patterns are easy to read at scale. The goal is behaving well, since hiding is neither possible nor necessary on an open protocol.
What happens if I hit a rate limit?
The API rejects the request and a well-built tool backs off automatically. In practice, an account growing an audience should never get anywhere near the published limits. If you do, your pacing is off by an order of magnitude.
Is follow-unfollow against the rules?
Aggressive churn reads as manipulation and ages badly with the people on the other end. A single cleanup pass after a fair wait window, which keeps everyone who engaged with you, is list hygiene rather than churn, and it stays well inside normal behavior.
Do I need to label my account as automated?
Accounts that post autonomously should identify as automated. A tool that follows and engages at your direction is closer to an assistant than to a bot, so disclosure is your call. Honesty about how you operate never hurts on this network.
Automation on Bluesky is a solved problem when the tool respects the network. If you would rather inherit those guardrails than build them, start a free SkyFollowing trial; the defaults are already on the right side of every line in this guide.
SkyFollowing applies these safety rules to every campaign it runs. Free for 7 days, no card required.