Deprecation notice: Bitbucket Cloud app password brownout schedule and next steps

[#1]

Hi everyone,

Last year, we shared our blog announcement about the deprecation of app passwords in Bitbucket Cloud. API tokens are the replacement, offering improved security, expiration controls, and centralized management. To help teams identify and migrate any remaining usage ahead of the enforcement date, we will run a series of controlled brownouts from June 9, 2026 to July 27, 2026, after which app passwords will be fully removed on July 28, 2026.

Official timelines for end of life for app passwords

Phase 1: Phase out app passwords in the weeks leading up to end of life

Effective: June 9, 2026

In the final weeks of support for app passwords, we will run a series of brownouts from June 9, 2026 to July 27, 2026 to increase awareness of remaining usage. During these pre-planned brownout scheduled time, app passwords will be unavailable, highlighting where customers will need to make changes.

If you have already switched to using API tokens, your functionality will not be interrupted. We encourage all customers to switch to using API tokens as soon as possible

During each brownout window:

• All API requests authenticated using app passwords will fail with an HTTP 401 error code

• All Git-over-HTTPS operations authenticated using app passwords will fail with an HTTP 410 error code

Please see the below schedule for the list of planned brownouts.

Brownout schedule	Brownout duration per window	Brownout window start times (UTC)
Jun 09, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 10, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 11, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 12, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 13, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 14, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 15, 2026	15 minutes	00:00, 06:00, 12:00, 18:00
Jun 16, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 17, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 18, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 19, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 20, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 21, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 22, 2026	30 minutes	00:00, 06:00, 12:00, 18:00
Jun 23, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 24, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 25, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 26, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 27, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 28, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 29, 2026	1 hour	00:00, 06:00, 12:00, 18:00
Jun 30, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 01, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 02, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 03, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 04, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 05, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 06, 2026	2 hours	00:00, 06:00, 12:00, 18:00
Jul 07, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 08, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 09, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 10, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 11, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 12, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 13, 2026	3 hours	00:00, 06:00, 12:00, 18:00
Jul 14, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 15, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 16, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 17, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 18, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 19, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 20, 2026	4 hours	00:00, 06:00, 12:00, 18:00
Jul 21, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 22, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 23, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 24, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 25, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 26, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 27, 2026	5 hours	00:00, 06:00, 12:00, 18:00
Jul 28, 2026	Final removal

Phase 2: End of life of app passwords

Effective: July 28, 2026

App passwords will be moved into the end of life phase. This means that app passwords will no longer work and all integrations that rely on them will not function.

What does end of life mean?

• App passwords are removed: App password authentication will be permanently disabled and will return errors. No further bug fixes or restores will be provided.

• Transition is required: Any app, integration, or script using app passwords must move to API tokens.

• No support or compatibility guarantees: App passwords will be unsupported, unmonitored, and may be removed from documentation and tooling at any time.

How to create API tokens

1. Navigate to Profile icon > Account settings > Security

2. Select Create and manage API tokens > Create API token with scopes

3. Name the token, set an expiry date, select Bitbucket as the app, and assign the necessary scopes.

4. Update your integration credentials with the new API token. (note: the token is displayed only once)

For detailed guidance, see the API token documentation. If you need assistance, reach out to support or use this community space to leave your comments. We are here to help.

[Juhi Purswani]

HI , i have tried APi token but it is not taking my API token to migrate PRs from bitbucket to Github
you have to check this newconfgiurations. app passwrods can only be used to migrate PRs from bitbucket to Github 

[Sonya Spangelo]

Is there a place to check the status of everyone's migration? Like a list of all users using creds instead of a token?

[Tristan Kosciuch]

Update: You apparently CAN use username:token! Thank you atlassian support.

A bit frustrating is the username:token syntax no longer works. If you want to continue to use api tokens in git clone commands, you need to switch to x-bitbucket-api-token-auth:token. x-bitbucket-api-token-auth takes the place of your username.

[Robert Gelb]

@Hamreet Kaur 

You might want to reconsider this steps.  App Passwords work fine and there are NO security issues with them.  

If you want to add API tokens for new users, by all means, do so.  But leave existing accounts with myriad of integrations, that will need to be dealt with now, alone.  At this point you are creating unnecessary work for everyone.  

You are literally giving us, your PAYING customers, more busy work that doesn't solve any problem.  

[Daniel Baber]

This has definitely been painful for us. Our infrastructure is a bit aged and we were on Bamboo 7.2.5. I've been pushing hard the last several days to upgrade to 10.2.20 Bamboo Data Center with upgraded agents and still trying to use old build things for really old Debian 9 machines. This has not been fun. It would be nice to be given a bit more time than 1 year.

[Lou Masters]

we ran into this on the 9th - it was a real pain.  Update our creds and everything was good until 2pm EST today - guess what?  

stderr: remote: CHANGE-3222 - Functionality has been deprecated
remote: App passwords are deprecated and must be replaced with API tokens.

can't figure out why this triggered again.  Opening a ticket to see what happened.

not a happy customer

[Jeff Kelley]

This is a major screwup. API tokens are not working and we are dead in the water. We're moving off of Bitbucket asap.

[bri-twhitney]

Quick question for @Hamreet Kaur

Are these Brownouts still happening, or has anything about the schedule from the original post been updated?  Same question for the final deprecation on the 28th -- is that still on schedule?

The reason I ask is that, after being affected by the first brownout on the 9th, we haven't run into any further interruptions despite intentionally attempting to test some changes during a few of the subsequent scheduled Brownouts.  From our end, it seemed like the Brownouts weren't happening.

Thanks in advance!

[Ben]

Hi @Jeff Kelley 

I'm sorry to hear you're encountering issues with API tokens. I've raised a ticket on your behalf with our support team - you will receive a response from our support team during your working hours.

Kind Regards,

- Ben (Bitbucket Cloud Support)

[Krosan89]

anybody got renovate migrated to those API tokens? i did see the even changed some code for it but i always get 401