Tutorials
Bluesky profile in JavaScript
One authenticated call to /api/v1/bluesky/profile?handle=bsky.app, the response it returned, and the line that reads one field out of it.
What you need
Node 18 or later, where fetch is global. No package to install. The same code runs in a browser, except that a browser would expose your key — call this from your server.
The call
const url = "https://honesthook.com/api/v1/bluesky/profile?handle=bsky.app";
const response = await fetch(url, {
headers: { Authorization: `Bearer ${process.env.HH_KEY}` },
});
if (!response.ok) {
throw new Error(`HTTP ${response.status}`);
}
const envelope = await response.json();
console.log(envelope.success, envelope.platform, envelope.endpoint);
What came back
{
"success": true,
"platform": "bluesky",
"endpoint": "bluesky/profile",
"data": {
"author": {
"id": "did:plc:z72i7hdynmk6r22z27h6tvur",
"handle": "bsky.app",
"name": "Bluesky",
"followers": 35065417,
"following": 15,
"posts_count": 864,
"verified": false,
"is_private": null
}
},
"error": null,
"cached": false
}
Recorded response, captured 27 Sep 2026. A live call returns the value at the moment you ask, not this one.
Every field in that capture
| In JavaScript | Type in this capture |
|---|
envelope.success | boolean |
envelope.platform | string |
envelope.endpoint | string |
envelope.data.author.id | string |
envelope.data.author.handle | string |
envelope.data.author.name | string |
envelope.data.author.followers | number |
envelope.data.author.following | number |
envelope.data.author.posts_count | number |
envelope.data.author.verified | boolean |
envelope.data.author.is_private | null |
envelope.error | null |
envelope.cached | boolean |
A field we cannot read comes back null, never 0. A zero would be a claim about the account; null is a fact about our collection.
Reading one field
console.log(envelope.data.author.followers);
envelope is the object from the block above. Keep the key on the server: a key shipped to a browser is a key anyone can read.
Bluesky's AT Protocol is public and documented, and this is the cheapest read of the set. As with GitHub, the interesting part is not access — it is identity.
The handle is not the identity
On Bluesky a handle is a domain name pointed at an account. It can be changed, released and taken by someone else. The thing that does not move is the DID, and that is what this endpoint returns as id.
If you are storing Bluesky accounts, store the DID. A table keyed on handles will quietly follow the wrong account the first time somebody renames, and nothing will error.
What you are calling
One authenticated GET to our endpoint, with your key in an Authorization header. The handle in the example is the one that produced the recorded response below, and the response carries its DID.
What comes back is the same envelope as every other platform here, so the client you wrote for one reads this one too.
Before you copy the block
Keep the key in an environment variable — all three examples read HH_KEY.
Then read the field list. Bluesky has no private profile at all, so that field is null rather than false — absent is not the same as negative, and this envelope keeps the two apart.