Documented steps

For your own home timeline (posts from accounts you follow): GET $PDSHOST/xrpc/app.bsky.feed.getTimeline?limit=<n>&cursor=<token>&algorithm=<optional> with header Authorization: Bearer <accessJwt> - this returns account-private data (your own follow graph), so it must be called authenticated against your PDS, not the public AppView.
For a given author's posts (no auth required): GET https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=<did-or-handle>&limit=<n>&cursor=<token>&filter=<option>&includePins=<bool>.
Both endpoints accept limit (integer, 1-100, default 50) and cursor (opaque string token) as query params.
getAuthorFeed's 'filter' param controls what's included, one of: posts_with_replies (default), posts_no_replies, posts_with_media, posts_and_author_threads, posts_with_video.
Each response contains a 'feed' array (of feedViewPost items) and an optional 'cursor' string. To page forward, pass the previous response's 'cursor' value as the next request's cursor param; stop paginating when the response omits 'cursor' or 'feed' comes back empty.
getTimeline's optional 'algorithm' param selects a variant timeline algorithm, but the API reference notes most feed flexibility has moved to the separate feed-generator mechanism (app.bsky.feed.getFeed with a feed generator URI) rather than this parameter.
Send an Accept-Language header (comma-separated 2-letter codes, e.g. 'en,es') on feed-generator (getFeed) requests to bias results toward the user's preferred language, per the viewing-feeds tutorial.

Known gotchas

The reference documentation states: 'Most app.bsky.* GETs are public and can be called without authentication against the Bluesky AppView at https://public.api.bsky.app. POSTs (writes) and any endpoint that returns account-private data require auth.' getTimeline returns account-private data (your specific follow graph) and therefore requires an authenticated request routed through your own PDS - it is not available on the public AppView.
getAuthorFeed's own description explicitly says 'Does not require auth', so it can be called on the cached public.api.bsky.app host for public, unauthenticated reads at scale.
public.api.bsky.app is the cached endpoint Bluesky asks developers to use for 'public web' use cases; api.bsky.app is a similar direct AppView endpoint but without the caching layer - neither of these public hosts supports authentication.
limit is capped at 100 per request for both endpoints (default 50) - request more pages via cursor rather than a larger limit value.
Authenticated requests should be sent to the account's own PDS (which may proxy to backend services as needed), not assumed to always be bsky.social - only use bsky.social as the PDS host for accounts actually hosted by Bluesky.

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Read a Bluesky account's home timeline and a specific author's post feed, using cursor-based pagination and filter parameters, and know which of the two requires authentication.

Documented steps

Known gotchas

Give your agent this knowledge — and 15,500+ more routes

Need this verified for your stack — or a route we don't have yet?