How Bluesky Follow-Back Tools Work

A follow-back tool should answer one question first: who follows this account that it does not already follow?

The useful part is comparing the two sides of the relationship and making the review manageable. A tool should not blindly follow every new follower on a timer. Bluesky's developer guidelines treat automated or bulk interactions that generate notifications — including follows — as spam.

What a follow-back tool reads

Bluesky identifies accounts with Decentralized Identifiers, or DIDs. Handles can change; the DID remains the account identifier that a client uses for follow records.

A follow-back tool normally does this:

  1. Fetch a page of the connected account's followers.
  2. Read whether the connected account already follows each person.
  3. Keep the followers without an existing follow relationship.
  4. Fetch enough profile data to support a useful review.
  5. Let the account owner choose whom to follow.

Bluesky's official following tutorial shows the underlying operations. Creating a follow writes an app.bsky.graph.follow record. Unfollowing deletes that record by URI.

That API is the mechanical part. It cannot decide whether an account is useful, trustworthy, active, or relevant to you.

Review profiles before taking action

Do not turn "follows me" into the only rule. A new follower may be a person you want to know, a quiet reader, a bot, an abandoned account, or an account that posts about something you do not want in your feed.

I check a few concrete signals:

  • the display name, handle, bio, and profile links
  • recent original posts and replies
  • whether the account has a subject I want in my timeline
  • shared communities or mutual connections
  • obvious impersonation, copied posts, or link spam

Follower and following counts can add context, but they are not a bot detector. A new account can be legitimate. An old account with a polished profile can still be spam.

Use search and filters to reduce a large list, then open the profiles that remain. Keep the final decision with the account owner.

TheBlue.social uses reviewed actions

TheBlue.social's Bluesky follow-back tool lists recent followers that the connected account does not follow. The free tier fetches up to 100 recent followers; paid Bluesky and Pro tiers raise that fetch limit to 2,000.

You can search and filter the list, review profiles, select matches, and confirm the count before any follow action runs. The tool also supports individual actions. That is different from a background rule that follows every new account while you are offline.

Large accounts should work through smaller groups. A 2,000-profile review limit does not mean you should select 2,000 people and follow them at once.

Keep follow-back work supervised

Rate limits are not an automation allowance

Bluesky publishes rate limits for repository writes. At the time of this update, Bluesky-hosted accounts receive 5,000 write points per hour and 35,000 per day. Creating a record costs three points; deleting one costs one.

Those numbers protect infrastructure. They are not a recommendation for how many accounts to follow.

Bluesky's developer guidelines separately prohibit automated or bulk interactions that create notifications, and the rate-limit documentation warns that prolific bots and bulk or spammy interactions can trigger other moderation limits. A script staying below the numerical write limit can still behave like spam.

When an API returns 429 Too Many Requests, stop and wait for the server's reset information. Do not rotate credentials or spread the same actions across several processes to bypass the limit.

Avoid unattended follow-back rules

Rules such as "follow every account older than 30 days" sound selective but do little to protect the feed. Account age does not tell you whether the posts are relevant. A minimum post count does not tell you what those posts contain.

Unattended follow-back also creates avoidable problems:

  • spam accounts can use the rule to gain a follow
  • an impersonator can pass simple age and activity checks
  • the account owner does not see what is being added to the feed
  • a broken cursor or retry loop can repeat more actions than intended
  • a scheduled batch can keep running after the owner changes strategy

Use filters to build a review queue, not to remove the review.

A practical follow-back workflow

1. Fetch a limited recent group

Start with a number you can inspect. For a busy account, review the newest 50 or 100 followers instead of trying to clear the entire history in one sitting.

2. Remove obvious non-matches

Search for the subjects, languages, locations, or profile terms that matter to the account. Exclude obvious spam and accounts whose posts do not fit the feed you want.

3. Open uncertain profiles

Read recent posts. Check identity through a linked domain when identity matters. Do not rely on an avatar, follower count, or verification badge alone.

4. Confirm a small group

Select only the accounts you meant to select. Read the confirmation count before running the actions. Smaller groups make mistakes easier to spot and recover from.

5. Inspect failures before retrying

A follow may fail because of a changed profile state, expired authorization, a service interruption, or a rate limit. Check which actions succeeded. Retry only the failed accounts after fixing the cause.

Keep an action receipt while processing a group. The receipt only needs the target DID, intended action, completion state, and error category. It should not contain passwords, session tokens, or complete API responses. If the browser closes or the network drops, use the receipt and the current Bluesky relationship to decide what remains. Do not restart the whole group and hope duplicate requests are harmless.

After a partial failure, refresh the selected profiles before retrying. Someone may have changed a handle, removed the follow, blocked the account, or deleted the profile while the group was running.

6. Read the feed afterward

The point of following someone is to change what you can see and whom you can talk to. If the additions make the feed worse, narrow the next review instead of processing more names.

Protect the connected account

Prefer OAuth when a tool supports it. If a tool still uses Bluesky app passwords, create one dedicated app password for that tool. Do not provide the main Bluesky password.

Revoke an app password after disconnecting a tool you no longer use. A local script should store credentials outside source code and logs, reuse sessions instead of repeatedly signing in, and stop cleanly on authorization or rate-limit errors.

Frequently asked questions

Does Bluesky include automatic follow-back?

Bluesky provides follow and unfollow actions, but it does not include a setting that automatically follows each new follower. Third-party tools can help compare relationships and organize a review.

Is it safe to follow back everyone?

No. A follow says nothing about the account's identity, relevance, or behavior. Review the profile and recent posts, then follow the accounts you want in the feed.

How many people can I follow at once?

Bluesky publishes technical rate limits, not a recommended batch size. Other anti-spam rules also apply. Use small, reviewed groups and stop when the service returns an error or rate-limit response.

Can a tool identify every bot follower?

No. Profile fields, account age, ratios, and posting activity can help with review, but none of them proves that an account is automated or malicious. TheBlue does not label accounts as bots.

Should a follow-back tool run every few hours?

There is no need for a background rule that follows people on a timer. Fetch a recent group when you are ready to review it, choose the accounts, confirm the actions, and inspect the feed afterward.

Last updated: August 12, 2026