Bluesky's age assurance sucks, here's how to work around it.

bluesky-osa.md

Bluesky's age assurance sucks, here's how to work around it.

Bluesky has implemented age verification measures in response to regional laws that restrict access, prompting users to verify their age through Epic Games' Kids Web Services before they can access adult content.

This sucks, but thankfully there are ways to work around it.

Before diving in: I encourage you to read this entire document, including the Background section explaining why these workarounds work, and What you can do next for ways to address the root cause.

Workaround methods

Method 0. VPN

This was obvious, but using a VPN to connect from outside your location will bypass the age assurance requirements entirely.

If you don't already have one, a VPN routes your connection through servers in other countries and prevents your ISP from tracking and selling your browsing data, though you're essentially trading trust from your ISP to your VPN provider instead.

My personal recommendations are Mullvad, IVPN or ProtonVPN.

Don't fall for VPN services that heavily focus on marketing, especially if they market features like "military-grade encryption" or make exaggerated privacy claims.

Method 1. Third-party clients

You don't have to use the official Bluesky app to access the platform.

Note that these alternatives work only as long as their developers don't implement similar age assurance measures or block users outright.

Bluesky app forks

• my own thing (no support is provided)
• mu
• Witchsky

Third-party clients

• Impro
• Klearsky
• TOKIMEKI

Method 2. Custom adblock filter rules

You can add the following filter rules to your adblocker.

||ip.bsky.app/geolocation$replace=/.*/{"countryCode":"US","regionCode":"DE"}/
/xrpc/app.bsky.ageassurance.getConfig$replace=/.*/{"regions":[]}/
/xrpc/app.bsky.ageassurance.getState$replace=/.*/{"state":{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2022-11-17T00:35:16.391Z"}}/

! for Chrome MV2/Helium users
bsky.app,main.bsky.dev##+js(trusted-replace-fetch-response, '/.*/', '{"countryCode":"US","regionCode":"DE"}', 'ip.bsky.app/geolocation')
bsky.app,main.bsky.dev##+js(trusted-replace-fetch-response, '/.*/', '{"regions":[]}', '/xrpc/app.bsky.ageassurance.getConfig')
bsky.app,main.bsky.dev##+js(trusted-replace-fetch-response, '/.*/', '{"state":{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2022-11-17T00:35:16.391Z"}}', '/xrpc/app.bsky.ageassurance.getState')

for uBlock Origin (Firefox, Helium)

1. Open uBlock Origin dashboard › My filters
2. Enable Enable my custom filters
3. Enable Allow custom filters requiring trust
4. Add the rules provided above

for Brave browser (Desktop, Android)

1. Open Settings › Shields › Content filtering
2. Enable Developer mode
3. Add the rules provided above to Create custom filters

for Ghostery (Firefox)

1. Open Ghostery extension window › Ad-Blocking › Custom Filters
2. Make sure it's enabled
3. Add the rules provided above

for Adguard (Firefox)

1. Open Adguard Settings › User Rules
2. Make sure it's enabled
3. Add the rules provided above

for Adguard (Android)

Note: Custom filter rules is a paid feature on the Android version.

Based on testing, this seems to produce wonky results. The setup process is also more complex. But if it works, it allows you to use Bluesky's Android app as usual.

1. Create a text file containing the filter rules provided above and save it to somewhere accessible
2. Open Adguard and navigate to Settings › Filtering › Filters › Custom Filters › Add custom filter
3. Tap Browse and locate the text file you created
4. Select the file to add it as a custom filter list

Method 3. Custom DNR rules (Chrome, Safari)

Chrome's Manifest v3 changes broke all adblockers including uBlock Origin by replacing the webRequest API that they rely on with the less powerful declarativeNetRequest API instead. uBlock Origin Lite was created specifically to work with DNR, and thankfully it's still very usable for our purposes.

1. Install uBlock Origin Lite
   • Chrome
   • Safari
2. Open uBlock Origin Lite dashboard
3. Enable Developer mode
4. Head to Develop › View: Custom DNR rules
5. Insert the following rules:

---
priority: 1
action:
  type: redirect
  redirect:
    url: https://gist.githubusercontent.com/mary-ext/6e27b24a83838202908808ad528b3318/raw/geolocation-response.json
condition:
  requestDomains:
    - ip.bsky.app
  initiatorDomains:
    - bsky.app
    - main.bsky.dev
  urlFilter: /geolocation
  resourceTypes:
    - xmlhttprequest
---
priority: 1
action:
  type: redirect
  redirect:
    url: https://gist.githubusercontent.com/mary-ext/6e27b24a83838202908808ad528b3318/raw/getConfig-response.json
condition:
  initiatorDomains:
    - bsky.app
    - main.bsky.dev
  urlFilter: /xrpc/app.bsky.ageassurance.getConfig
  resourceTypes:
    - xmlhttprequest
---
priority: 1
action:
  type: redirect
  redirect:
    url: https://gist.githubusercontent.com/mary-ext/6e27b24a83838202908808ad528b3318/raw/getState-response.json
condition:
  initiatorDomains:
    - bsky.app
    - main.bsky.dev
  urlFilter: /xrpc/app.bsky.ageassurance.getState
  resourceTypes:
    - xmlhttprequest
---

Method 4. Userscripts and Brave scriptlets

You can use userscripts, or scriptlets in Brave.

for userscript extensions

1. Install a userscript manager

   • Chrome: Violentmonkey
   • Firefox: Violentmonkey
   • Edge: Violentmonkey
   • Safari: Userscripts

2. Install this userscript

for Brave browser (Desktop)

Open Settings › Shields › Content filtering (or go to about:adblock)

Enable Developer mode, and add the following scriptlet, saving it as user-bsky-age-assurance.js.

const _fetch = globalThis.fetch;
globalThis.fetch = async function (req, init) {
	if (req instanceof Request) {
		const url = new URL(req.url);

		switch (url.pathname) {
			case '/xrpc/app.bsky.ageassurance.getConfig': {
				return Response.json({
					regions: [],
				});
			}
			case '/xrpc/app.bsky.ageassurance.getState': {
				return Response.json({
					state: {
						lastInitiatedAt: '2025-07-14T14:22:43.912Z',
						status: 'assured',
						access: 'full',
					},
					metadata: {
						accountCreatedAt: '2022-11-17T00:35:16.391Z',
					},
				});
			}
		}
	} else if (req === 'https://ip.bsky.app/geolocation') {
		return Response.json({
			countryCode: 'US',
			regionCode: 'DE',
		});
	}

	return _fetch.call(this, req, init);
};

Then reference the scriptlet in a custom filter.

bsky.app,main.bsky.dev##+js(user-bsky-age-assurance.js)

Method 5. Self-hosted PDS

If your account is hosted on a PDS you own or control, you can add these rules to your Nginx or Caddy configuration.

for Nginx users:

server {
	server_name pds.example.com;

	location /xrpc/app.bsky.ageassurance.getState {
		default_type application/json;
		add_header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy" always;
		add_header access-control-allow-origin "*" always;
		return 200 '{"state":{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2022-11-17T00:35:16.391Z"}}';
	}
}

for Caddy users:

pds.example.com {
	handle /xrpc/app.bsky.ageassurance.getState {
		header content-type "application/json"
		header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
		header access-control-allow-origin "*"
		respond `{"state":{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2022-11-17T00:35:16.391Z"}}` 200
	}
}

Background

Bluesky's implementation of age-based content restrictions is entirely client-side, this is an intentional design decision. The API (called the "AppView") doesn't impose content restrictions directly and isn't aware of your location as requests to it are proxied through the hosting server that your account resides in (called the "PDS.")

bsky.app (or the "client") determines your location and restriction status through a series of API calls:

1. https://ip.bsky.app/geolocation returns your location:

   • countryCode: your country based on IP address
   • regionCode: your state/region code

2. <pds host>/xrpc/app.bsky.ageassurance.getConfig returns the restriction configuration:

   • regions: list of regions with age assurance requirements

3. <pds host>/xrpc/app.bsky.ageassurance.getState returns your verification status:

   • state.status: your account's verification status
   • state.lastInitiatedAt: when you last started identity verification
   • state.access: your access level (full, limited, etc.)
   • metadata.accountCreatedAt: when your account was created

These workarounds exploit the client-side nature of these checks.

Worth noting that decentralized social networks aren't above the law. All platforms, including Mastodon and other federated networks, must comply with local regulations like the Online Safety Act, and a fully decentralized network may need individual server operators to handle compliance.

It remains unclear whether regulators would consider Bluesky's client-side implementation sufficient for legal compliance. However, Bluesky Social PBC could reasonably argue the restrictions are effectively enforced for users on their PDS using unmodified clients, and that's as far as they can guarantee in a decentralized network like Bluesky.

I am not a lawyer however.

What you can do next

Yelling at Bluesky might feel good, but this issue only exists because your lawmakers passed it, and they're the ones who can repeal it. Consider taking action to address the root cause:

Contact your representatives

The ask is the same wherever you are: tell your lawmakers how age-verification mandates harm privacy, free speech, and digital rights. Find your representatives and the relevant law below.

Region	Relevant law	Find your representatives
Australia	Online Safety Amendment ("Social Media Minimum Age") Act 2024	Australian Parliament
UK	Online Safety Act	UK Parliament
Brazil	Lei nº 15.211/2025 (the "ECA Digital")	Câmara dos Deputados · Senado Federal
Mississippi	HB 1126	Mississippi Legislature
Ohio	HB 96	Ohio Legislature
South Dakota	HB 1053	South Dakota Legislature
Tennessee	HB 1891	Tennessee General Assembly
Texas	SB 2420 (the "App Store Accountability Act")	Texas Legislature
Virginia	SB 854	Virginia General Assembly
Wyoming	HB 43	Wyoming Legislature

Support digital rights organizations

Consider supporting or getting involved with organizations that advocate for digital rights and privacy:

International:

• Electronic Frontier Foundation (EFF) - Defends civil liberties in the digital world
• Internet Freedom Foundation - Works to ensure that technology respects fundamental rights

Australia-specific:

• Digital Freedom Project - Challenging Australia's social media age ban in the High Court
• Electronic Frontiers Australia - Campaigns for digital freedoms and civil liberties online

UK-specific:

• Open Rights Group - Campaigns for digital rights and freedoms in the UK
• Big Brother Watch - Fights for privacy, free speech and civil liberties

US-specific:

• American Civil Liberties Union (ACLU) - Defends constitutional rights including digital privacy
• Fight for the Future - Campaigns for digital rights and internet freedom

bluesky-osa.user.js

// ==UserScript==
// @name         Bluesky age assurance bypass
// @version      2.0
// @match        https://bsky.app/*
// @match        https://main.bsky.dev/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

const _fetch = globalThis.fetch;
globalThis.fetch = async function (req, init) {
	if (req instanceof Request) {
		const url = new URL(req.url);

		switch (url.pathname) {
			case '/xrpc/app.bsky.ageassurance.getConfig': {
				return Response.json({
					regions: [],
				});
			}
			case '/xrpc/app.bsky.ageassurance.getState': {
				return Response.json({
					state: {
						lastInitiatedAt: '2025-07-14T14:22:43.912Z',
						status: 'assured',
						access: 'full',
					},
					metadata: {
						accountCreatedAt: '2022-11-17T00:35:16.391Z',
					},
				});
			}
		}
	} else if (req === 'https://ip.bsky.app/geolocation') {
		return Response.json({
			countryCode: 'US',
			regionCode: 'DE',
		});
	}

	return _fetch.call(this, req, init);
};

geolocation-response.json

{
	"countryCode": "US",
	"regionCode": "DE"
}

getConfig-response.json

{
	"regions": []
}

getState-response.json

{
	"state": {
		"lastInitiatedAt": "2025-07-14T14:22:43.912Z",
		"status": "assured",
		"access": "full"
	},
	"metadata": {
		"accountCreatedAt": "2022-11-17T00:35:16.391Z"
	}
}

they're just dates i picked at the time