nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Deprecation notice: Bitbucket Cloud app password brownout schedule and next steps

Hamreet Kaur

Hi everyone,

Last year, we shared our blog announcement about the deprecation of app passwords in Bitbucket Cloud. API tokens are the replacement, offering improved security, expiration controls, and centralized management. To help teams identify and migrate any remaining usage ahead of the enforcement date, we will run a series of controlled brownouts from June 9, 2026 to July 27, 2026, after which app passwords will be fully removed on July 28, 2026.

Official timelines for end of life for app passwords

Phase 1: Phase out app passwords in the weeks leading up to end of life

Effective: June 9, 2026

In the final weeks of support for app passwords, we will run a series of brownouts from June 9, 2026 to July 27, 2026 to increase awareness of remaining usage. During these pre-planned brownout scheduled time, app passwords will be unavailable, highlighting where customers will need to make changes.

If you have already switched to using API tokens, your functionality will not be interrupted. We encourage all customers to switch to using API tokens as soon as possible

During each brownout window:

All API requests authenticated using app passwords will fail with an HTTP 401 error code
All Git-over-HTTPS operations authenticated using app passwords will fail with an HTTP 410 error code

Please see the below schedule for the list of planned brownouts.

Brownout schedule	Brownout duration per window	Brownout window start times (UTC)
Jun 09, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 10, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 11, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 12, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 13, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 14, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 15, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 16, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 17, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 18, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 19, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 20, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 21, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 22, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 23, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 24, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 25, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 26, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 27, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 28, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 29, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 30, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 01, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 02, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 03, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 04, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 05, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 06, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 07, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 08, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 09, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 10, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 11, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 12, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 13, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 14, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 15, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 16, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 17, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 18, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 19, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 20, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 21, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 22, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 23, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 24, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 25, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 26, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 27, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 28, 2026	Final removal

Phase 2: End of life of app passwords

Effective: July 28, 2026

App passwords will be moved into the end of life phase. This means that app passwords will no longer work and all integrations that rely on them will not function.

What does end of life mean?

App passwords are removed: App password authentication will be permanently disabled and will return errors. No further bug fixes or restores will be provided.
Transition is required: Any app, integration, or script using app passwords must move to API tokens.
No support or compatibility guarantees: App passwords will be unsupported, unmonitored, and may be removed from documentation and tooling at any time.

How to create API tokens

Navigate to Profile icon > Account settings > Security
Select Create and manage API tokens > Create API token with scopes
Name the token, set an expiry date, select Bitbucket as the app, and assign the necessary scopes.
Update your integration credentials with the new API token. (note: the token is displayed only once)

For detailed guidance, see the API token documentation. If you need assistance, reach out to support or use this community space to leave your comments. We are here to help.

Comments

Juhi Purswani

HI , i have tried APi token but it is not taking my API token to migrate PRs from bitbucket to Github
you have to check this newconfgiurations. app passwrods can only be used to migrate PRs from bitbucket to Github

Sonya Spangelo

Is there a place to check the status of everyone's migration? Like a list of all users using creds instead of a token?

Tristan Kosciuch_nuynp0

Update: You apparently CAN use username:token! Thank you atlassian support.

A bit frustrating is the username:token syntax no longer works. If you want to continue to use api tokens in git clone commands, you need to switch to x-bitbucket-api-token-auth:token. x-bitbucket-api-token-auth takes the place of your username.

Robert Gelb_d5mj5e

@Hamreet Kaur

You might want to reconsider this steps. App Passwords work fine and there are NO security issues with them.

If you want to add API tokens for new users, by all means, do so. But leave existing accounts with myriad of integrations, that will need to be dealt with now, alone. At this point you are creating unnecessary work for everyone.

You are literally giving us, your PAYING customers, more busy work that doesn't solve any problem.

Daniel Baber

This has definitely been painful for us. Our infrastructure is a bit aged and we were on Bamboo 7.2.5. I've been pushing hard the last several days to upgrade to 10.2.20 Bamboo Data Center with upgraded agents and still trying to use old build things for really old Debian 9 machines. This has not been fun. It would be nice to be given a bit more time than 1 year.

Lou Masters

we ran into this on the 9th - it was a real pain. Update our creds and everything was good until 2pm EST today - guess what?

stderr: remote: CHANGE-3222 - Functionality has been deprecated
remote: App passwords are deprecated and must be replaced with API tokens.

can't figure out why this triggered again. Opening a ticket to see what happened.

not a happy customer

Jeff Kelley

This is a major screwup. API tokens are not working and we are dead in the water. We're moving off of Bitbucket asap.

bri-twhitney

Quick question for @Hamreet Kaur

Are these Brownouts still happening, or has anything about the schedule from the original post been updated? Same question for the final deprecation on the 28th -- is that still on schedule?

The reason I ask is that, after being affected by the first brownout on the 9th, we haven't run into any further interruptions despite intentionally attempting to test some changes during a few of the subsequent scheduled Brownouts. From our end, it seemed like the Brownouts weren't happening.

Thanks in advance!

Ben

Hi @Jeff Kelley

I'm sorry to hear you're encountering issues with API tokens. I've raised a ticket on your behalf with our support team - you will receive a response from our support team during your working hours.

Kind Regards,

- Ben (Bitbucket Cloud Support)

Krosan89

anybody got renovate migrated to those API tokens? i did see the even changed some code for it but i always get 401

msjothiraj

It's very headache to us and eats our time. In this article, there is no steps after create the API token. kindly give to solve the commands.

git pull

remote: CHANGE-3222 - Functionality has been deprecated

remote: App passwords are deprecated and must be replaced with API tokens.

remote: https://developer.atlassian.com/cloud/bitbucket/changelog#CHANGE-3222

Adm_i6rvki

Token generated, new token authentication added to SourceTree, and appears as OK. Works for one day, the next day, when trying to pull or send, it displays the error:

CHANGE-3222 - Functionality has been deprecated

App passwords are deprecated and must be replaced with API tokens.

https://developer.atlassian.com/cloud/bitbucket/changelog#CHANGE-3222

Unable to access 'https://bitbucket.org/xxxxxxx/xxxxxxxxxxx.git/': The requested URL returned error: 410

Every day we need to generate new tokens and link them to SourceTree.

We need a solution.

Mommens

API Tokens don't work !!

I got it working last week, today nothing works. not even creating new tokens ....

Pushing to https://bitbucket.org/xxxx/xxxx.git/

remote: CHANGE-3222 - Functionality has been deprecated

remote: App passwords are deprecated and must be replaced with API tokens.

remote: https://developer.atlassian.com/cloud/bitbucket/changelog#CHANGE-3222

fatal: unable to access 'https://bitbucket.org/xxxx/xxxx.git/': The requested URL returned error: 410

Locked out of all Codebases !!

Hasini Pandigama

Lauren Salk_jsxcb9

Same as above commenters, we managed to find steps to set up the API tokens. We set them up, and still get frequent 410 interruptions which are slowing down our work.

idealsur

Hola, API token no funciona con GitHub Desktop, creamos los tokens pero no permite usar. Pueden dar más detalle de cómo debería funcionar?

Geetha Golla

i tried using API token in linux, but it still says, i dont have access to my repository but when the burn out period is over, it works with password, what to di, it is effecting the work

Lizhong Gao

I tried username and api token as password in VS code with git extension, but not working

Domtec Sistemas

In Jenkins (CI/CD) doesn't work. I tried so many times but 410 persists.

Denise Skidmore

Does this change also break OAuth client tokens? This broke last week. I tried generating a new token thinking it might be the new 90 day expiration, but that didn't help. The support AI also tried to get me on a method using a proxy but that also failed. (Contacting the REST API from within a pipeline.)

Turns out my problem was a different API change, not authentication.

Leo Bartkus

Please don't do this to ssh auth. This has been painful enough already. The documentation is really lacking and i'm not sure that api keys are compatible with all of the tools in the git ecosystem. Its really not clear if they are supposed to work or not to auth with to commandline git, or what scopes I need to select to just simply automate commandline git.

Mommens

For those who still have the issue this worked for us :

Add the API_token in the url ( This is very unsafe i know )

https://{bitbucket_username}:{API_token}@bitbucket.org/{workspace}/{repository}.git

Try to push something and you will see this error

remote: You may not have access to this repository or it no longer exists in this workspace. If you think this repository exists and you have access, make sure you are authenticated.

Remove the API_token from the url again and try pushing again. This worked for all our repos ...

This entire API_token approach feels highly unstable at the moment ! We hope they fix it soon, and we hope the above might help some of you !

Darcy Leo

Thanks for the detailed migration timeline. The scheduled brownouts are a helpful way to identify any remaining dependencies on app passwords before the final removal."

Martin Charlesworth_rywlwv

This has been very painful to get working, but FWIW this is what I have found out by trial and error. For BB API commands you have to use your email address as the username - NOT your BB username. And the api token as the password. But for git cli usage you have to use your BB username, NOT you email address!!

Sachin Naiksatam

We are getting this error

The default value has been returned
An error occurred while download data
Command "git ls-remote -h -- https://{XXX}-Infrastructure@bitbucket.org/{workspace}/{repo-name}.git" returned status code 128: stdout: stderr: remote: CHANGE-3222 - Functionality has been deprecated remote: App passwords are deprecated and must be replaced with API tokens. remote: https://developer.atlassian.com/cloud/bitbucket/changelog#CHANGE-3222 fatal: unable to access 'https://bitbucket.org/{workspace}/{repo-name}.git/': The requested URL returned error: 410
Please look at the Log
Please check the configuration

sometimes it work sometimes it gives above error. Can we get proper solution?

Daniel Baber

Well I upgraded all our stuff to 10.2.20 for now.....was a slog.

Laura Donovan_kwco22

Like most others in this thread, I am getting constant 410 errors citing the deprecation of app passwords. The documented solution does not resolve the issue, even if I add all available scopes to the API token, even after removing all other credentials through Windows Credentials Manager, even after restarting Bitbucket and rebooting my work machine entirely.

These constant brownouts with no working solution have left our development in a lurch for large swaths of our workdays. Hopefully a viable solution is found as soon as possible...

Steve Mills

This has definitely been a block for us, when all we want to do is get things done. Seems like barely any testing was done before tossing it over to actual users.

Richard Brookes-Tee

I've managed to get the API Tokens working on Windows with the latest version of SourceTree.

For me the issue was that SourceTree isn't using the stored Windows Credentials, it was using a cached version of my old credentials which was being controlled by the Embedded Version of Git which SourceTree was using because I have the default "Allow Sourcetree to manage my credentials via the Git Credential Manager" checked.

After upgrading the Embedded Git Version, then choose "Manager" to from a prompt, then when doing a fetch on my repo was prompted to login. I now had a much more modern looking login prompt. And tried the API Token option. It worked, but had to renter the token into the password on every fetch. So, tried the OAUTH option, used my email/api token, and it worked. Rebooted, and on a different day and its still working...

Maybe I could of unchecked the "Allow Sourcetree to manage my credentials via the Git Credential Manager", but I think this might be the cause of the errors for most.

Laura Donovan_kwco22

@Richard Brookes-Tee Thanks for the advice, updating the embedded Git version helped me get past the 410 errors when they started up again this morning. I kept the "Allow Sourcetree to manage my creds..." checkbox checked, and I made sure to set my API token as the default method in the Authentication tab. After that I fetched, and I got the prompts you mentioned with the modern authentication flow. Not sure if my authentication will persist, but having to authenticate multiple times is much better than not being able to access source control for hours at a time.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud