[steveklabnik]

You make an "app password" which is basically an API token.

They've recently added OAuth, but since it's pretty new, a lot of older projects haven't moved over yet.

2FA exists but only for emails right now, more to come. https://github.com/bluesky-social/social-app/issues/1071

[the_gipsy]

Okay that makes sense, thanks! And yea, I meant OAuth, 2FA has really nothing to do.