# Bluesky Proxies: What the API Returns

> Bluesky measured from five countries: the public API needs no account, returns 1 KB instead of 2.5 MB, and only the moderation header changes by exit.

[Home](https://quanticdata.io/)/[Blog](https://quanticdata.io/blog/)/Bluesky Proxies: What the API Returns

# Bluesky Proxies: What the API Returns

Social proxiesSep 18, 2026·11 min read·By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData

One unauthenticated Bluesky API request sent through five proxy exit countries on 18 September 2026: the response body is 3,232 bytes from all five, but Germany, Turkey and Brazil also receive a country-specific moderation labeler in the atproto-content-labelers header, while the United States and Japan receive only the global one

On this page [What bsky.app serves a client that does not run JavaScript](/blog/bluesky-proxies/#what-bsky-app-serves-a-client-that-does-not-run-javascript) [The public API is the product, and it is unauthenticated](/blog/bluesky-proxies/#the-public-api-is-the-product-and-it-is-unauthenticated) [What the exit country really changes](/blog/bluesky-proxies/#what-the-exit-country-really-changes) [Which proxy type Bluesky actually needs](/blog/bluesky-proxies/#which-proxy-type-bluesky-actually-needs) [Rate limits, and the three errors you will actually see](/blog/bluesky-proxies/#rate-limits-and-the-three-errors-you-will-actually-see) [What this costs](/blog/bluesky-proxies/#what-this-costs) [What we will not help you do](/blog/bluesky-proxies/#what-we-will-not-help-you-do)

Bluesky is the one large social network that answers a proxied client honestly: its public API needs no account, no token and no browser, and it returned the same bytes to us from five countries on 18 September 2026. What the exit country did change was not the data but the moderation instruction attached to it. Here is every measurement, and the short list of cases where a proxy is actually the right tool.

## What bsky.app serves a client that does not run JavaScript

We read one public profile, *bsky.app/profile/bsky.app*, twice from each of four exit countries on 18 September 2026 between 05:33 and 05:35 UTC: once as a plain HTTP client and once through a real browser.

| Exit | No-JS pass | Rendered pass | Verdict |
| --- | --- | --- | --- |
| US | 200, 47 words, h1 is *JavaScript Required* | 200, 1,093 words | Hydrated |
| BR | 200, 47 words, identical shell | 200, 1,107 words | Hydrated |
| DE | 200, 47 words, identical shell | 200, 113 words | Partial shell |
| JP | 200, 47 words, identical shell | 200, 47 words | Never hydrated |

The no-JS view is the same 47-word shell every time, and its h1 says so out loud. The rendered view is worse than it looks: only two passes out of four produced the post list inside the capture window, and the two that failed returned HTTP 200 with a plausible-looking page. That is the expensive failure mode of rendering a single-page app — you do not get an error, you get a short page you might store as if it were empty.

The server does put something useful in the shell for bots: the title, the profile description, the Open Graph tags and a *ProfilePage* JSON-LD block are all present without JavaScript, and the canonical URL never goes missing. So a link preview works. A dataset does not. We measured the same split with the [SEO Audit API](https://quanticdata.io/seo-audit/), which fetches both views in one call at $0.0012 per URL.

## The public API is the product, and it is unauthenticated

Bluesky runs on the AT Protocol, and its read layer is exposed at *public.api.bsky.app*. Bluesky's own documentation says these direct endpoints do not support authentication and asks developers to use the cached public host for public web use cases. We confirmed it: no key, no cookie, no session.

| Request | Status | On-wire bytes | What came back |
| --- | --- | --- | --- |
| Profile page HTML, no JS | 200 | 19,947 | Nothing readable — an empty shell |
| Profile page, browser render | 200 | 2,655,017 | 4,826 words, 58 images, 12.8 s |
| *app.bsky.actor.getProfile* | 200 | 1,054 | DID, handle, display name, avatar, banner, followers, follows, posts, creation date, pinned post |
| *app.bsky.feed.getAuthorFeed*, limit 1 | 200 | 3,232 | One post with text, facets, embeds, plus like, repost, reply, quote and bookmark counts |

One kilobyte of JSON answers the question that 2.5 megabytes of rendered page answers badly. The follower count we read from the US exit was 34,942,093 and from Japan, ninety seconds later, 34,942,094 — a live counter, not a regional difference. Responses carry *cache-control: public, max-age=30* and are served from a CDN edge in the requesting country.

The practical rule for Bluesky is the opposite of the rule for most platforms: do not render, and do not parse HTML. Point a plain HTTP client at the API, through whatever exit you like. If you want that wrapped — retries, geo pinning, clean output, batching over a URL list — our [web scraping API](https://quanticdata.io/web-scraping-api/) bills $0.0002 per page without rendering and $0.001 with it, and the same calls are available to an agent through the [MCP server](https://quanticdata.io/mcp-server/).

## What the exit country really changes

This is the measurement nobody has published. We sent the identical request — *app.bsky.feed.getAuthorFeed* with limit 1 — through five exit countries within four minutes. The response body was **3,232 bytes from all five**. The *atproto-content-labelers* response header was not.

| Exit | Payload | Labelers named in the response header |
| --- | --- | --- |
| US | 3,232 B | *moderation.bsky.app* |
| JP | 3,232 B | *moderation.bsky.app* |
| DE | 3,232 B | *moderation.bsky.app* plus *moderation-de.bsky.app* |
| TR | 3,232 B | *moderation.bsky.app* plus *moderation-tr.bsky.app* |
| BR | 3,232 B | *moderation.bsky.app* plus *moderation-br.bsky.app* |

Those extra identifiers arrive as raw DIDs. We resolved all four through the same public API: they are the Bluesky Moderation Service and its national counterparts, described in German, Turkish and Portuguese respectively, each created on a different date — Brazil in September 2024, Turkey in March 2025.

So country restrictions on Bluesky are labels, not blocks. The AppView hands your client a list of moderation services appropriate to the IP it sees; honouring them is the client's job, which is exactly why reporting on the Turkish restrictions in 2025 noted that third-party apps did not hide what the official app hid. For a data team this cuts both ways. Rotating your exit will not reveal hidden posts, because nothing was hidden at the API. But pinning an exit is the only way to discover *which* national labeler applies to a given market, and that is a real brand-safety question: if you publish on Bluesky and want to know whether German or Brazilian readers are being shown a label on your account, you have to ask from inside that country. A country-pinned exit from our [residential network](https://quanticdata.io/residential-proxies/) answers it for a fraction of a cent.

## Which proxy type Bluesky actually needs

The honest answer is the cheapest one. The public API applied no bot challenge, no TLS fingerprint check and no CAPTCHA to any of our fourteen requests, and the payloads are small enough that bandwidth price stops mattering. What you are buying is address diversity against a per-IP request ceiling, not trust.

| Type | Use it on Bluesky when | Skip it when |
| --- | --- | --- |
| Datacenter, from $0.50/GB | Reading the public API at volume — this is the default and it is enough | Never, for public reads |
| Residential, from $0.80/GB | You need a specific country's labeler view, or your datacenter range is being limited as a block | You only need the data, which is country-independent |
| Static ISP, from $2.50/IP per month at volume | You run a long-lived firehose consumer or your own PDS and want a stable, reputable address | Short polling jobs, where rotation is more useful than stability |
| Mobile, from $2.30/GB | We found no Bluesky read case that justifies it | Reading public data — you would be paying 4.6 times the datacenter rate for nothing |

If you want rotation without managing a pool, the [rotating endpoint](https://quanticdata.io/rotating-proxies/) gives a fresh IP per request from one hostname. A minimal read through a country-pinned exit looks like this:

```
curl -x http://USER-country-de:PASS@dc.quanticdata.io:7777 \
  "https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=bsky.app" \
  -D - -o profile.json
```

Keep the *-D -*. On Bluesky the headers are half the answer.

## Rate limits, and the three errors you will actually see

Bluesky publishes its limits, which is rare enough to be worth quoting precisely. Overall API requests against a PDS or the entryway are limited **by IP, at 3,000 per 5 minutes**. Write operations are limited per account instead: 5,000 points per hour where a create costs 3 points, an update 2 and a delete 1, which the docs work out to a maximum of 1,666 records created per hour. Account creation is capped at 100 per 5 minutes per IP, and session creation at 30 per 5 minutes per account.

You will read elsewhere that Bluesky's limits attach to identity rather than address. That is true of the write limits and false of the read limits, and the difference decides your architecture: unauthenticated reading is bounded by how many addresses you have, which is the one legitimate reason to put a proxy pool in front of a Bluesky collector at all.

The *robots.txt* at bsky.app is unusually direct. It greets crawlers, points them at the protocol and its firehose, disallows exactly one path — the compose intent — and states that HTTP 429 is the backoff signal and that "up to a handful concurrent requests should be ok". Read that as your pacing budget: a handful of concurrent connections per address, backing off on 429.

| Response | Shape | What it means |
| --- | --- | --- |
| 400 | JSON: error *InvalidRequest*, message *Profile not found*, 56 bytes | Your input is wrong, not your IP. A missing handle is a 400 here, not a 404 |
| 403 | HTML from the CDN, no JSON error body | The endpoint is not exposed on the public host. We got this on *searchPosts*: search is not part of the unauthenticated surface |
| 429 | Documented backoff status | You crossed a limit. Slow down; changing address does not make the limit go away, it only spreads it |
| 200 with *JavaScript Required* | 47-word HTML shell | You fetched the web app instead of the API. Repoint the client |

One warning from our own data: none of the successful responses from the public host carried *ratelimit-* headers, even though the documentation describes header-based backoff for the network's services generally. At the cached public edge you get no advance warning, so treat 429 as the only signal and pace conservatively.

## What this costs

All figures at our published rates, using the byte counts measured above.

| Job | Route | Transfer | Cost |
| --- | --- | --- | --- |
| 1,000 profile lookups | Public API | 1.05 MB | $0.0005 at $0.50/GB |
| 1,000 profile lookups | Rendered web app | 2.65 GB | $1.24 at $0.50/GB, $2.12 residential |
| 1,000,000 profile lookups | Public API | 0.98 GB | $0.49 at $0.50/GB |
| 100,000 posts with engagement counts | Public API, author feeds | 0.30 GB | $0.15 at $0.50/GB |

Rendering costs 2,519 times the bandwidth of asking the API the same question, and fails two times in four. A gigabyte of datacenter transfer holds roughly 1,018,000 profile responses or 332,000 post records. Every account also gets $2 of free API usage per month, which covers a first pass at a Bluesky dataset without a card. Note one inversion: for responses this small, per-gigabyte proxy billing beats per-page API billing, so the plain proxy route is the cheaper of our two products here. We would rather say that than sell you the wrong one.

There is no Bluesky collector in our [catalogue](https://quanticdata.io/collectors/), and given the above there is not much of a case for one — the API is already the clean JSON a collector would hand you. Where collectors earn their keep is on platforms that fight back: [Reddit posts](https://quanticdata.io/collectors/reddit-scraper-api/) at $0.0005 per post, [Instagram profiles](https://quanticdata.io/collectors/instagram-scraper-api/) at $0.006, [YouTube search](https://quanticdata.io/collectors/youtube-scraper-api/) at $0.0008 per video. The contrast with [what Instagram returns to a proxied client](https://quanticdata.io/blog/instagram-proxies/) is the whole argument for the open protocol.

## What we will not help you do

The other proxy guides on this keyword sell Bluesky multi-accounting through anti-detect browsers, account warming and registration at scale. We will not write that, for a plain reason: Bluesky's Community Guidelines treat bulk and spammy interaction as a violation, and its own rate-limit documentation names "prolific bots" as the thing the write limits exist to stop. A proxy does not change either fact, and no proxy restores a banned account.

What the open protocol does legitimately support is the rest of the list: public post and profile collection, social listening, creator and audience research, brand monitoring, checking whether a national labeler applies to your own account, and archiving your own organisation's posts. All of it runs on unauthenticated reads, none of it needs an account, and that is why Bluesky is the easiest social platform to work with honestly — the one place where doing it the sanctioned way is also the cheap way.

Two obligations survive the openness. Public does not mean unlicensed: posts remain their authors' content and personal data under the GDPR and similar regimes, so purpose, retention and deletion still apply. And deletion propagates on an open network: if an author removes a post, a dataset that keeps serving it is your problem, not theirs.

### Sources & further reading

- [Bluesky Protocol Services — Rate Limits](https://bsky.network/docs/rate-limits)

- [bsky.app/robots.txt](https://bsky.app/robots.txt)

- [AT Protocol](https://atproto.com/)

- [Bluesky Community Guidelines](https://bsky.social/about/support/community-guidelines)

- [Bluesky, censorship and country-based moderation — Fediverse Report](https://fediversereport.com/bluesky-censorship-and-country-based-moderation/)

- [Bluesky 2025 Transparency Report](https://bsky.social/about/blog/01-29-2026-transparency-report-2025)

## FAQ

Quick answers on bluesky proxies.

[Something else? Ask us →](mailto:hello@quanticdata.io)

### Do I need a proxy to collect Bluesky data?

Not for small volumes. The public API at public.api.bsky.app is unauthenticated and answered every one of our requests without a challenge. You need a proxy pool when you exceed the documented ceiling of 3,000 API requests per 5 minutes per IP, or when you want to read from inside a specific country to see which national moderation labeler applies there.

### Which proxy type is best for Bluesky?

Datacenter, from $0.50/GB. Bluesky applied no bot challenge or fingerprint check to our requests, and the responses are around one kilobyte, so you are buying address diversity rather than trust. Residential at $0.80/GB is worth it only when you need a specific country exit; we found no read case on Bluesky that justifies mobile at $2.30/GB.

### Does the exit country change what Bluesky returns?

Not the data. On 18 September 2026 the same request returned exactly 3,232 bytes from the United States, Germany, Turkey, Japan and Brazil. What changed was the atproto-content-labelers header: Germany, Turkey and Brazil each received an additional national moderation labeler, which the client is expected to honour. Country restrictions on Bluesky are applied by the client, not by the API.

### Can I scrape bsky.app directly instead of using the API?

You can fetch it, but there is nothing in it. Without JavaScript the profile page is a 47-word shell whose h1 reads JavaScript Required, identical from four countries. Rendering it cost 2,655,017 bytes and still failed to hydrate in two of our four passes, returning HTTP 200 with a short page rather than an error.

### What do Bluesky rate limits actually apply to?

Both an address and an account, depending on the operation. Overall API requests against a PDS or the entryway are limited by IP at 3,000 per 5 minutes. Writes are limited per account at 5,000 points per hour, where a create costs 3 points, an update 2 and a delete 1. Crossing a limit returns HTTP 429, which robots.txt names as the backoff signal.

### Is searching Bluesky posts available without an account?

No. The app.bsky.feed.searchPosts endpoint on the public host returned 403 with an HTML body from the CDN rather than a JSON error, which is the shape of an endpoint that is not exposed publicly rather than a block on your IP. Author feeds, profiles, threads and follower graphs are available unauthenticated.

### Will a proxy help me run multiple Bluesky accounts?

We do not publish that guidance. Bluesky Community Guidelines treat bulk and spammy interaction as a violation, and its rate-limit documentation names prolific bots as the reason the per-account write limits exist. No proxy changes an account-level limit, and none restores a suspended account.

## Read Bluesky the cheap way

Datacenter exits from $0.50/GB, country-pinned residential when you need a national view, and $2 of free API usage every month. One key covers proxies, scraping and the MCP server.

[Start free — $2/month included](https://quanticdata.io/signup/)[Explore Datacenter Proxies from $0.50/GB](https://quanticdata.io/datacenter-proxies/)

## Related reading

[Social proxies Instagram Proxies: What the Site Returns Instagram publishes a profile's follower, following and post counts in its meta tags and almost nothing in the DOM. Eight measured passes across four surfaces and four exit countries, the two error shapes that lie to you, and the cost math per profile. Read →](https://quanticdata.io/blog/instagram-proxies/) [Proxies Best Residential Proxies in 2026, Tested Thirteen residential proxy providers, priced from their own pages on 8 September 2026 - eleven publish a rate, two could not be verified, and every sub-dollar figure on the market turns out to carry a commitment. Plus 170 requests through our own residential pool with the raw rows attached: 49/50 success, 50/50 country match, 41 ASNs, 1.26 s median TTFB, 20 of 20 sticky sessions holding one IP, a median fraud score of 2 - and the finding that 95% of our exits are catalogued as other networks' nodes too. Read →](https://quanticdata.io/blog/best-residential-proxies-tested/) [Proxies Golang HTTP Client Proxy: Auth, SOCKS5 How to attach a proxy to an http.Client in Go, authenticate over CONNECT, use SOCKS5 from the standard library and rotate exits per request, with a measurement of how far a no-JavaScript client actually gets. Read →](https://quanticdata.io/blog/golang-http-client-proxy/)

## Also on this site

Quantic**Data**

Residential proxies & web data APIs for AI.

#### Proxies

- [Residential Basic](https://quanticdata.io/residential-proxies/#basic)

- [Residential Premium](https://quanticdata.io/residential-proxies/#plans)

- [Cheap Residential](https://quanticdata.io/cheap-residential-proxies/)

- [Mobile Proxies](https://quanticdata.io/mobile-proxies/)

- [Datacenter Proxies](https://quanticdata.io/datacenter-proxies/)

- [ISP Proxies](https://quanticdata.io/isp-proxies/)

- [Rotating Proxies](https://quanticdata.io/rotating-proxies/)

- [Sneaker Proxies](https://quanticdata.io/sneaker-proxies/)

- [SOCKS5 Proxies](https://quanticdata.io/socks5-proxies/)

- [IPv6 Proxies](https://quanticdata.io/ipv6-proxies/)

- [Proxy locations](https://quanticdata.io/proxies/)

#### Data APIs

- [MCP Server](https://quanticdata.io/mcp-server/)

- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

- [SERP API](https://quanticdata.io/serp-api/)

- [Collectors](https://quanticdata.io/collectors/)

- [Web Data for AI](https://quanticdata.io/web-data-api-for-ai/)

- [Quantic AI](https://quanticdata.io/ai-web-scraping-service/)

- [Crawl & Map](https://quanticdata.io/crawl-map/)

- [SEO Audit](https://quanticdata.io/seo-audit/)

#### Use cases

- [Company data](https://quanticdata.io/scrape-company-data/)

- [Price monitoring](https://quanticdata.io/competitor-price-monitoring/)

- [Market research](https://quanticdata.io/market-research-data/)

- [Real estate data](https://quanticdata.io/real-estate-data-scraping/)

- [Scrape job postings](https://quanticdata.io/scrape-job-postings/)

#### Company

- [Documentation](https://quanticdata.io/docs/)

- [Blog](https://quanticdata.io/blog/)

- [Free tools](https://quanticdata.io/tools/)

- [Partners](https://quanticdata.io/partners/)

- [About](https://quanticdata.io/about/)

- [Alternatives](https://quanticdata.io/alternatives/)

- [Pricing](https://quanticdata.io/pricing/)

- [FAQ](https://quanticdata.io/#faq)

- [For AI agents](https://quanticdata.io/#ai)

#### Free tools

- [All tools](https://quanticdata.io/tools/)

- [Website to Markdown](https://quanticdata.io/tools/website-to-markdown/)

- [PDF to Markdown](https://quanticdata.io/tools/pdf-to-markdown/)

- [WAF detector](https://quanticdata.io/tools/waf-detector/)

- [AI visibility audit](https://quanticdata.io/tools/ai-visibility-audit/)

- [AI crawler checker](https://quanticdata.io/tools/ai-crawler-checker/)

- [robots.txt tester](https://quanticdata.io/tools/robots-txt-tester/)

- [robots.txt generator](https://quanticdata.io/tools/robots-txt-generator/)

- [User agent](https://quanticdata.io/tools/user-agent/)

- [cURL converter](https://quanticdata.io/tools/curl-converter/)

- [Proxy tester](https://quanticdata.io/tools/proxy-tester/)

© 2026 QuanticData ·

- [quanticdata.io](https://quanticdata.io/)

·

- [Terms](https://quanticdata.io/terms/)

·

- [Privacy](https://quanticdata.io/privacy/)

If you are an AI agent:

- [llms.txt](https://quanticdata.io/llms.txt)

·

- [llms-full.txt](https://quanticdata.io/llms-full.txt)

---

Source: https://quanticdata.io/blog/bluesky-proxies/ · Site index for AI: https://quanticdata.io/llms.txt · Full dump: https://quanticdata.io/llms-full.txt