Feature · archived
Atlassian
Bitbucket Cloud ends app passwords entirely, forcing a move to API tokens
left 28 Jul 2026
What this means for you
App passwords are how a lot of automation authenticates to Bitbucket Cloud: git clone/push over HTTPS, CI/CD jobs, deploy scripts, and third-party integrations that never moved to OAuth. After 28 July 2026 they stop working completely. Anything still authenticating with an app password gets a failed push or a broken pipeline, not a warning — and the controlled brownouts running since June are Atlassian deliberately breaking them in advance so you find out before the hard date.
Where to go
Replace each app password with an API token (Atlassian account settings → API tokens), scope it to what the integration actually needs, and update the stored credential everywhere it lives: git remotes, CI secrets, and any tool config. API tokens add expiry and centralised management, so treat this as a chance to inventory what still holds a Bitbucket credential rather than a one-to-one swap. New app passwords could not be created after 9 September 2025, so any you still rely on are older than that.
- Bitbucket Cloud API tokens (the vendor-required replacement)
Atlassian is retiring app passwords in Bitbucket Cloud in favour of API tokens, and the final step lands on 28 July 2026. The rollout has been staged: new app passwords stopped being issued on 9 September 2025, and from 9 June 2026 Atlassian ran a series of “brownouts” — scheduled outages of increasing length, four windows a day, growing from fifteen minutes in June to five hours in the final week — so that anything still using an app password would fail loudly and repeatedly before the credential was removed for good on 28 July.
This is the kind of sunset that breaks working systems silently, because app-password auth is usually set up once and forgotten. The credential sits in a CI secret, a git remote URL, or a backup script, and keeps working for years until the day it doesn’t. The affected surface is broad: HTTPS git access, pipelines, and any integration that predates Bitbucket’s push toward OAuth and tokens.
The replacement — API tokens — is straightforward to create and is the only supported path forward, so there is no decision to make here, only work to do: find every place an app password is stored and swap it before the date. Atlassian’s stated reason is security (tokens carry expiry and scoping that app passwords lack), which is credible, but the practical takeaway for anyone integrating with Bitbucket is simpler: an app password is a dead credential in a few days.
Entry changelog
- — last reviewed.
- — Entry created from the official Atlassian announcement and published brownout schedule.
- — Re-verified inside the 30-day window (§3.5) via scripts/reverify.py, which flagged that the previously-cited source (the main deprecation blog) states the 9 June brownout-start date but not the 28 July final-removal date. Repointed sourceUrl to Atlassian's dedicated brownout-schedule notice, which states it explicitly: brownouts run 9 June–27 July, growing from 15-minute to 5-hour windows, full removal 28 July 2026. Date re-confirmed unchanged.
- — Sunset date reached. Status moved to passed — the final removal of Bitbucket Cloud app passwords lands today, 28 July 2026, after the escalating brownout schedule. App passwords no longer authenticate; API tokens are required.
Spot an error or a changed date? Tell us and it’s corrected the same night.