Is there a Bluesky scraper API that works without an App Password?

Yes. Social Fetch Bluesky routes read public profile and post data. You authenticate to Social Fetch with an API key (x-api-key). You do not create a Bluesky App Password or open an AT Protocol session as the user whose public data you are fetching.