Bluesky API Rate Limits: AppView, PDS and Write Points

November 9, 2026

Bluesky is a network of services, not one server, and each service sets its own limits. The question is never "what is the Bluesky limit" but "which host is this request going to". Pricing and access are in Is the Bluesky API free?; the protocol tour is in Bluesky scraper and AT Protocol API. This post is the limits in depth.

AppView vs PDS: which limit applies

From Bluesky's rate limits page. The key point: an authenticated read goes through your PDS and counts against its per-IP limit. The same read sent unauthenticated to public.api.bsky.app does not, and that host is cached. Bluesky asks developers to use it for public web use.

Bluesky API rate limits on the PDS

Login is the limit that surprises people. A script that calls createSession on every run can lock its account out after 30 runs in 5 minutes. Save the session and use refreshSession.

Write points: how many records an account can create

Writes are limited in points, per account (DID), on top of the HTTP limit. The budget is 5,000 points an hour and 35,000 a day.

Two things follow. The daily budget equals 7 hours at the hourly maximum, so a bot that writes flat out hits the daily wall after 7 hours. And com.atproto.repo.applyWrites does not save points: each record in the batch is counted. Bluesky adds that bulk or spammy likes and follows break its Community Guidelines whatever the limit allows.

points = 3 x creates + 2 x updates + 1 x deletes
ok if points_last_hour <= 5000 and points_last_day <= 35000

Bluesky rate limit headers

We called bsky.social on 9 November 2026 and got these headers:

ratelimit-limit: 3000
ratelimit-remaining: 2999
ratelimit-reset: 1794282274     # Unix time, in seconds
ratelimit-policy: 3000;w=300    # 3,000 requests per 300-second window

They follow an earlier version of the IETF RateLimit header draft. The same day, a call to public.api.bsky.app returned no rate limit headers, only cache-control: public, max-age=30. So for the public host, handle 429 when it comes; for the PDS, pace by the headers.

How many calls can you really make per day?

Reading 5,000 accounts daily. app.bsky.actor.getProfiles takes at most 25 actors per call, so 5,000 profiles is 200 calls. Their latest posts via app.bsky.feed.getAuthorFeed, at up to 100 posts per call, is 5,000 more. (The API rejects limit=101 with "maximum 100", which we checked the same day.) Sent to the public host: 5,200 calls under an unpublished but generous limit. Sent authenticated through the PDS: 5,200 calls against 3,000 per 5 minutes per IP, so at least 10 minutes, and it shares that budget with your other logged-in traffic.

A reply bot. 1,000 replies a day cost 3,000 points, under 9% of the daily write budget. Add likes on each mention and it is 6,000 points. Writes are rarely the limit for a well-behaved bot.

Polling vs streaming. If you poll 5,000 accounts every 10 minutes, that is 720,000 calls a day. One firehose or Jetstream connection gives you every public post in real time with no polling.

Python: pace by RateLimit headers

import random, time, requests

def bsky_get(host, method, session=None, **params):
    headers = {"Authorization": "Bearer " + session} if session else {}
    for attempt in range(6):
        r = requests.get(host + "/xrpc/" + method, params=params, headers=headers, timeout=30)
        remaining = r.headers.get("ratelimit-remaining")
        reset = r.headers.get("ratelimit-reset")
        if r.status_code == 429:
            wait = int(reset) - time.time() if reset else min(60, 2 ** attempt)
            time.sleep(max(wait, 1) + random.random())
            continue
        r.raise_for_status()
        if remaining is not None and int(remaining) < 50 and reset:
            time.sleep(max(int(reset) - time.time(), 0))
        return r.json()
    raise RuntimeError("rate limited")

PUBLIC = "https://public.api.bsky.app"
profiles = bsky_get(PUBLIC, "app.bsky.actor.getProfiles", actors=["bsky.app", "atproto.com"])

Can you get higher Bluesky limits?

• AppView: Bluesky asks you to contact it if you hit limits on the public hosts.
• Relay limits for a new PDS: Bluesky says it will raise the defaults for growing instances on request.
• Self-hosting: a PDS you run sets its own HTTP limits, but the Relay and AppView still apply theirs, and other providers on the network have their own.

When a paid API is simpler

Bluesky's API is free and its public host is generous, so for Bluesky alone the official API is usually the right choice. A paid API helps when Bluesky is one column in a report that also covers X, Threads and TikTok. ScrapeIO allows 300 requests a minute per API key, with no daily or monthly cap beyond the credits you hold. A 429 from ScrapeIO costs nothing, and neither do failed calls, private or not-found answers, or cached repeats.

ScrapeIO's bluesky profile API, bluesky user posts API and bluesky post API return Bluesky data in the same fields as every other platform, at 1 credit a call. Agents can use the Bluesky MCP server.

FAQ

How many posts can a Bluesky account make per day?

Up to 11,666 records a day at 3 points each, and 1,666 an hour. Likes, follows and reposts count as records too.

Does a like count against the same limit as a post?

Yes. A like is a record create, so it costs 3 points, the same as a post.

Do these limits apply to self-hosted PDS servers?

The PDS numbers are Bluesky's own servers. A self-hosted PDS sets its own, while the Relay applies default limits to new PDS instances.

What does ratelimit-reset contain?

On Bluesky's PDS, a Unix timestamp in seconds for when the window refills.

Do I need to log in to read public Bluesky data?

No. Unauthenticated calls to public.api.bsky.app read public profiles and posts and keep your PDS budget free.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

• https://bsky.network/docs/rate-limits
• https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/