Authenticate an AI agent to the Bluesky API using a handle and app password, obtain accessJwt/refreshJwt, and refresh the session when the access token expires.

Documented steps

1. Generate an app password for the account at https://bsky.app/settings/app-passwords (do not use the main account password; createSession accepts it but an app password is the documented practice referenced by the API reference's server description).
2. Determine your PDS host: if hosted by Bluesky use https://bsky.social; if self-hosted use your own PDS hostname (e.g. https://pds.example.com). This is the $PDSHOST used for all authenticated requests.
3. POST $PDSHOST/xrpc/com.atproto.server.createSession with JSON body {"identifier": "<handle-or-other-identifier>", "password": "<app-password>"}. Optional fields: allowTakendown (bool), authFactorToken (string, needed if the account has 2FA and the server returns error AuthFactorTokenRequired).
4. Example: curl -X POST https://bsky.social/xrpc/com.atproto.server.createSession -H 'Content-Type: application/json' -d '{"identifier":"alice.bsky.social","password":"xxxx-xxxx-xxxx-xxxx"}'
5. Response (200) is required to include accessJwt, refreshJwt, handle, did; it may also include did, email, active, didDoc, status, emailConfirmed, emailAuthFactor. accessJwt expires after a few minutes; refreshJwt lasts much longer and is used only to mint a new accessJwt.
6. Attach the access token to every subsequent authenticated request as header: Authorization: Bearer <accessJwt>.
7. When accessJwt expires (requests start failing with ExpiredToken/InvalidToken), POST $PDSHOST/xrpc/com.atproto.server.refreshSession with header Authorization: Bearer <refreshJwt> (no request body). The response has the same shape as createSession and contains a new accessJwt (and possibly rotated refreshJwt) - store both.
8. Do not send the refreshJwt as a normal Bearer token to any other endpoint - it is only valid for refreshSession.