Error about app passwords, when I am using api token!

[bkeitch]

I am getting this error message:

remote: You are using an app password for Git over HTTPS.
remote: On September 9, 2025, the creation of app passwords will be discontinued.
remote: From that date forward, you will need to create and use API tokens.
remote: All existing app passwords will become inactive on June 9, 2026.
remote: More details:
remote: https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/

BUT my URL is: 

 git remote get-url --all origin
https://bkeitch:API KKEY@bitbucket.org/bkeitch/arduino.git

so why the error message??

[Syahrul · Accepted solution]

Hey @bkeitch 

Welcome to the community.

It is likely that a credential helper (such as the Windows Credential Manager or macOS Keychain) is overriding the credentials in your URL and injecting your old App Password automatically.

To confirm if Git is pulling a stored password from your system, you can run a clone command with verbose logging enabled:

GIT_CURL_VERBOSE=1 GIT_TRACE=1 git clone https://bitbucket.org/bkeitch/arduino.git

What to look for in the logs:

• trace: run_command: 'git-credential-...': This line identifies which helper is being used to fetch your credentials.

• Authorization: Basic ...: This shows that Git is sending an encoded credential to Bitbucket.

How to fix it:

If the logs show that a credential helper is active, you will need to clear the old entry so Git can use your new API token:

• Windows: Open Credential Manager > Windows Credentials. Find the entry for git:https://bitbucket.org and either update it with your new API token or delete it so Git prompts you for it again.

• macOS: Open Keychain Access, search for bitbucket.org, and delete the "internet password" entry.

• Linux: If you are using the store helper, check your ~/.git-credentials file and remove the line associated with Bitbucket.

Once the old credentials are cleared, the next time you perform a Git action, you will be prompted for your credentials. Use your Bitbucket username and your new API token as the password.

Hope this helps.

Regards,
Syahrul

[bkeitch]

Hi Syahrul, thanks for the detailed response. There was a stored password in the linux .git-credentials file that was causing the issue. 

Thanks

Ben

[bkeitch]

I still get the same message but this time I see this in the trace:

21:31:23.589996 run-command.c:655 trace: run_command: 'git credential-store store'
21:31:23.593481 git.c:460 trace: built-in: git credential-store store

so it looks like there is a fault where git is storing the password anyway? I deleted the line from the .gitcredentials, but it has come back!

[bkeitch]

and deleting, running push again, it stores it again!

[bkeitch]

ok removing the "store" line from gitconfig does it, but what if I want to store passwords for some repos and not others?