I don't understand these new tokens that replace passwords

[ryancw]

Hello. This is my first time using Atlassian Community.

I am a very low-level user of Bitbucket git. I have about 2 dozen private, sinlge-user repos, via a free account. I use them only to sync R scripts and LaTeX source files between different computers, and as a place to keep track of and store my version histories. Nothing fancy.

Now it seems I have to get API tokens. I've read this:

https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/

yet am still confused.

1. Do I need one token for me, that will work across all my repos? Or do I need a separate token for each repo?

2. What exactly is a token? Is it a file that gets stored on my computer? Or just a character string like a password?

4. On the page I referenced above, most of the instructions begin with "clone the repository like this . . . ." But I've already cloned all my repos long ago and have been using them right along. Do I have to clone them anew?

I'm sure I'll have more questions as I dig into this.

Grateful for any help. Thanks.

[Arkadiusz Wroblewski]

Hello @ryancw 

1. You probably do not need one token per repository.

For a simple single-user setup like yours, one user API token is usually enough across the repos your account can already access, as long as you give it the scopes you need. Atlassian describes API tokens as user-based, and their repository scopes apply to the repositories the user can access. 

2. A token is basically a long generated password string.

It is not something special you browse to like a repo. The important part is to store it somewhere safe, because Atlassian only shows it once when created. 

https://www.atlassian.com/blog/bitbucket/bitbucket-cloud-transitions-to-api-tokens-enhancing-security-with-app-password-deprecation

3. No, you do not need to clone all repositories again.

Atlassian explicitly documents that for repositories already cloned locally, you can just update the remote URL with git remote set-url origin ... instead of recloning

https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/

[ryancw]

Thank you, this is very helpful!

does

git config credential.helper store

work with the new API tokens?

[Arkadiusz Wroblewski]

@ryancw 

Yes, that should work with the new API tokens as well, because Git will just store the same username + token credential it uses for Bitbucket over HTTPS.

The only caution is that credential.helper store keeps the credential unencrypted on disk, so it is convenient, but not the safest option. If this is just a personal machine you control, many people still use it, but it is worth knowing the tradeoff.

[ryancw]

Understood.

[ryancw]

I created a token! I have yet to try it out. Thanks for all your help.

[Arkadiusz Wroblewski]

@ryancw 

You're welcome. 

Have a great Easter Weekend.