Deprecation notice: Bitbucket Cloud app password brownout schedule and next steps

[#1]

Hi everyone,

Last year, we shared our blog announcement about the deprecation of app passwords in Bitbucket Cloud. API tokens are the replacement, offering improved security, expiration controls, and centralized management. To help teams identify and migrate any remaining usage ahead of the enforcement date, we will run a series of controlled brownouts from June 9, 2026 to July 27, 2026, after which app passwords will be fully removed on July 28, 2026.

Official timelines for end of life for app passwords

Phase 1: Phase out app passwords in the weeks leading up to end of life

Effective: June 9, 2026

In the final weeks of support for app passwords, we will run a series of brownouts from June 9, 2026 to July 27, 2026 to increase awareness of remaining usage. During these pre-planned brownout scheduled time, app passwords will be unavailable, highlighting where customers will need to make changes.

If you have already switched to using API tokens, your functionality will not be interrupted. We encourage all customers to switch to using API tokens as soon as possible

During each brownout window:

• All API requests authenticated using app passwords will fail with an HTTP 401 error code

• All Git-over-HTTPS operations authenticated using app passwords will fail with an HTTP 401 error code

Please see the below schedule for the list of planned brownouts.

Brownout schedule	Brownout duration per window	Brownout window start times (UTC)
Jun 09, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 10, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 11, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 12, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 13, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 14, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 15, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 16, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 17, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 18, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 19, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 20, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 21, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 22, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 23, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 24, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 25, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 26, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 27, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 28, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 29, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 30, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 01, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 02, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 03, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 04, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 05, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 06, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 07, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 08, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 09, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 10, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 11, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 12, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 13, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 14, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 15, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 16, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 17, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 18, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 19, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 20, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 21, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 22, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 23, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 24, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 25, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 26, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 27, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 28, 2026	Final removal

Phase 2: End of life of app passwords

Effective: July 28, 2026

App passwords will be moved into the end of life phase. This means that app passwords will no longer work and all integrations that rely on them will not function.

What does end of life mean?

• App passwords are removed: App password authentication will be permanently disabled and will return errors. No further bug fixes or restores will be provided.

• Transition is required: Any app, integration, or script using app passwords must move to API tokens.

• No support or compatibility guarantees: App passwords will be unsupported, unmonitored, and may be removed from documentation and tooling at any time.

How to create API tokens

1. Navigate to Profile icon > Account settings > Security

2. Select Create and manage API tokens > Create API token with scopes

3. Name the token, set an expiry date, select Bitbucket as the app, and assign the necessary scopes.

4. Update your integration credentials with the new API token. (note: the token is displayed only once)

For detailed guidance, see the API token documentation. If you need assistance, reach out to support or use this community space to leave your comments. We are here to help.