Allow access tokens to push despite branch permissions

[Martin Karing]

How can I enable an access token to push to a branch that is protected from direct pushes from normal users.

I can't seem to setup the required permissions in Bitbucket.

I tried to setup a service account to work around that in admin.atlassian.com, but such a service user can't login to bitbucket, but it can get the required permissions to push despite the branch protections.

Who do I get this working?

[Ben]

Hi @Martin Karing 

Branch restrictions are only able to be applied to user accounts at this stage, as tokens aren't acccount-based - they can't be added.

• We have a feature request tracking this below that you may Watch to receive updates on and Vote for to improve its visibility with regard to customer demand:
  https://jira.atlassian.com/browse/BCLOUD-22400 

This means service accounts configured at the Atlassian Administration level will not count either - you would need to create an actual Bitbucket Cloud user account (which consumes a license seat) and assign the branch permission to it in the interim.

I hope this helps, please let us know if you have any further questions regarding the above.

Cheers!

- Ben (Bitbucket Cloud Support)

[Gabriela - LeanZero]

You can't, and it isn't your configuration. Branch restrictions exempt users and groups, and an access token is neither. The access token docs put it plainly: "Access tokens are tied to a repository, project, or workspace (rather than a user) and should not be shared." Nothing tied to a repository can go in a list that takes users.

That gap is BCLOUD-22400, "Add RAT, PAT and WAT user to branch restrictions", and at 426 votes it's the most requested thing in that corner of Bitbucket by a distance. Its own description reads "branch permissions only allow you to add users with a valid Bitbucket Cloud workspace and do not take into account users added by RAT/PAT/WAT".

Look at it before you build anything, though. It moved to In Progress, and the Bitbucket Team posted on 4 August that "we've commenced dev work for BCLOUD-22400, enabling repository, project, and workspace access tokens (RAT/PAT/WAT) to be used in branch restrictions", with "We're targeting early September for completion." That's a target rather than a ship date, but it's this month, so watch the ticket before you build much around a workaround.

Until then the route that works is a real Bitbucket user, because a user is what that field accepts. Which matches what you hit with the admin.atlassian.com service account, so I'd stop pushing on that one. Create an ordinary account for the automation, give it write access, add it to the exemption list on the restriction, and authenticate as it with an API token. Those are user-based, which is the whole difference here, and they've taken over from app passwords: "API tokens are user-based tokens for scripting tasks and integrating tools, for example CI/CD tools, with Bitbucket Cloud. They are the long term replacement for App passwords."