Bitbucket Cloud API Token Authentication

5 posts · Jun 2016 – Sep 2025

What this trail covers

Bitbucket Cloud is transitioning from app passwords to API tokens for authentication, enhancing security and control. This includes disabling the creation of new app passwords, requiring new integrations to use API tokens with scopes, and eventually disabling all app passwords. API tokens offer expiration control, centralized management, and modern scopes. Token rotation has been introduced, allowing users to generate a new secret and expiration date for existing tokens without reconfiguring scopes.

All Atlassian trails

Sep 2025Bitbucket Cloud enters phase two of app password deprecationThis post announces Phase 2 of the app password deprecation, where the creation of new app passwords is no longer allowed starting September 9, 2025. Existing app passwords remain valid until June 9, 2026. New integrations must use API tokens with scopes. The post reiterates the benefits of API tokens (expiration control, centralized management, modern scopes) and provides instructions for creating API tokens.
Jun 2025Bitbucket Cloud transitions to API tokens: enhancing security with app password deprecationThis post announces the deprecation of app passwords in Bitbucket Cloud and the transition to API tokens. It details the reasons for the change (expiration control, centralized management, modern scopes), the deprecation timeline (announcement, disabling new creation, full deprecation), and provides instructions on how to create API tokens. It also outlines next steps for users to review existing app passwords and start updating to API tokens.
Apr 2025Introducing token rotation for access tokensIntroduces token rotation for access tokens in Bitbucket Cloud. This feature allows users to generate a new secret and expiration date for existing access tokens while preserving their scopes. The rotation process has specific behaviors for tokens expiring soon or far in the future to ensure a smooth transition. The post details the UI steps for rotating tokens and mentions future enhancements to app passwords and other authentication methods.
Mar 2025Enhancing security in Bitbucket: Introducing expiry for access tokensIntroduces mandatory expiry for newly created access tokens in Bitbucket Cloud, with configurable durations (90, 180, 365 days) set by workspace admins. Allows admins to optionally permit tokens without expiry. This change aims to reduce the risk of data breaches by ensuring regular token rotation.
Jun 2016App passwords are here in Bitbucket CloudIntroduces application-specific passwords (app passwords) for Bitbucket Cloud. These passwords allow applications to access Bitbucket's API via HTTPS when 2-factor authentication is enabled. They offer granular scopes, usage history, and the ability to revoke passwords. Example usage with SourceTree and curl is provided.
Advertisement