Short answer: if Bluesky says "Rate limit exceeded" when you try to sign in, your account has used up its login allowance: 30 sign-ins per 5 minutes, or 300 per day. That limit is per account, not per device, so every app, bot and tool that signs in as you shares it. The usual cause isn't you. It's a third-party tool that signs in over and over instead of reusing its session.

The Login Limit

Logging in calls an endpoint named com.atproto.server.createSession. Bluesky's documentation lists its limits as:

  • 30 per 5 minutes, measured per account
  • 300 per day, measured per account

That's generous for a person: you'd never type your password 30 times in five minutes. But a script that creates a new session for every post, every check or every restart can use 300 in an afternoon, and once it has, nothing can sign in to the account, including you in the official app.

Why It Happens

  • A bot or script that logs in every run. A cron job that runs every five minutes and logs in each time uses 288 logins a day on its own. Add a few manual sign-ins and you're over.
  • A tool with a bug. Some tools retry the login in a loop when something else fails, and can burn the 5-minute allowance in seconds.
  • Several tools on one account. A scheduler, an analytics dashboard and a cross-poster, each signing in on its own schedule, add up.
  • Repeated failed attempts. Mistyping a password, or an app retrying an old app password you've revoked, still counts.

How to Fix It

  1. Stop trying for a while. If you've hit the 5-minute limit, wait 5 to 10 minutes. If you've hit the daily limit, it can take up to a day. Every retry in the meantime counts.
  2. Find the tools. In the Bluesky app, go to Settings → Privacy and security → App passwords. Every tool you've connected with an app password is listed by the name you gave it.
  3. Revoke what you don't use, or everything if you're not sure. Deleting an app password signs that tool out immediately, so it can't keep trying. You can make new passwords for the tools you want later. See how to create and revoke app passwords.
  4. Check tools signed in with OAuth too. Apps that use Bluesky's newer sign-in flow don't appear in the App passwords list. Sign out of them from inside the app.
  5. Add tools back one at a time. If the error returns after one of them, you've found it.

If You Wrote the Bot

The fix is almost always the same: log in once and keep the session. A session gives you an access token and a refresh token. Store both, use the access token until it expires, then call com.atproto.server.refreshSession with the refresh token. Refreshing isn't the same as logging in, so it doesn't use your 30-per-5-minutes allowance.

// @atproto/api: save the session, reuse it next run
import { AtpAgent } from "@atproto/api";
import fs from "node:fs";

const agent = new AtpAgent({
  service: "https://bsky.social",
  persistSession: (evt, session) => {
    if (session) fs.writeFileSync("session.json", JSON.stringify(session));
  },
});

if (fs.existsSync("session.json")) {
  await agent.resumeSession(JSON.parse(fs.readFileSync("session.json", "utf8")));
} else {
  await agent.login({ identifier: process.env.BSKY_HANDLE, password: process.env.BSKY_APP_PASSWORD });
}

Also: never retry a failed login in a tight loop. If login returns 429, read the ratelimit-reset header and wait until then. Our 429 retry guide has a wrapper that does this, and the bot guide covers session handling end to end.

Other Login Errors That Look Similar

  • "Invalid identifier or password": wrong handle or password, not a rate limit. If you changed your handle, try your email address.
  • "Token has expired" in a third-party app: the app's session ended. Signing in again fixes it.
  • A rate limit on everything, not just login: that's the per-IP request limit, 3,000 requests per 5 minutes. Try a different network. See our general rate-limit guide.

Frequently Asked Questions

How many times can you log in to Bluesky?

Bluesky's servers allow 30 sign-ins per account every 5 minutes and 300 per day. All apps and tools signed in as you share that limit.

How long does the Bluesky login rate limit last?

The short limit clears within about 5 minutes. If the daily limit of 300 has been used up, it can take up to a day.

Why am I rate limited when I haven't done anything?

Most often a third-party tool connected to your account is logging in repeatedly. Revoke unused app passwords in Settings, Privacy and security, App passwords.

Does refreshing a session count as a login?

No. Refreshing a session with a refresh token is a different endpoint and doesn't count against the 30-per-5-minutes login limit.

Will changing my password fix it?

It will sign out tools that use your main password, but app passwords keep working until you revoke them. Revoking the app passwords is the more direct fix.

Built on the Same API

Skyscraper is an independent Bluesky and Mastodon client for iPhone, iPad, Mac, Apple TV, Apple Watch and Vision Pro. Everything in this post comes from building it: caching, backoff and one long-lived session per account so you don't burn through your limits.

Download Skyscraper →

Related Reading