Authentication Fails

[nogray]

Today out of the sudden, the OAuth authentication started failed when I try to push and update or refresh the OAuth token from the options.

The browser window opens normal and I get the "Authentication Successful" message on the browser, but Sourcetree has an HTML document as an error which boils down to

Forbidden

CSRF verification failed. Request aborted.

Please enable 'Referer' headers for this site and try again.

Updated Sourcetree to the latest version and tried to remove the passwd, but nothing works.

[Mason Roller]

I'm also having this issue

[Abdul Shaik]

Same issue

[Peik Heirman]

Same here, maybe there is an error/problem on the side of Atlassian/sourcetree ?

[Jeffrey Manalang]

I got issue as well, 

The web version works fine for me, but the app can't authenticate.

[Peter Gilchrist]

[Peter Gilchrist]

Back online for me now.

[Peter Gilchrist]

Identified We have identified the likely cause of the issue, and our teams are diligently working on a mitigation. Affected users may experience OAuth login issues in Bitbucket. We will continue to share additional updates here as more information is available. Posted 12 minutes ago. Jun 11, 2026 - 23:21 UTC Investigating

[Jack Vanson]

Same issue for me too

[Or Perets]

Hello same happened to me today.

Only thing that worked is:

1. Change your account (settings->accounts) to work with auth type: API token

2. Create and use a scoped apiToken with all these EXACTLY (if you miss one it wont work):

read:user:bitbucket

read:workspace:bitbucket

read:repository:bitbucket

write:repository:bitbucket

Optional:

read:pullrequest:bitbucket

write:pullrequest:bitbucket

[Tomislav Tobijas]

Hey @nogray ,

Here's a related Bitbucket troubleshooting article around CSRF error(s): Error "Forbidden CSRF verification failed" occurs when trying to create a new Bitbucket account 

What you could try:

• Clear browser cache and cookies
• Try setting your default browser to incognito/private mode (temporarily)
• Disable browser extensions
• Switch default browsers

Alternatively, do a Sourcetree account reset:

1. Close Sourcetree.

2. Navigate to %LocalAppData%\Atlassian\SourceTree\ (Windows) or the equivalent Application Support folder (macOS).

3. Locate and rename or delete the passwd file (which you've tried) and also the accounts.json file to completely reset the account metadata.

4. Restart Sourcetree and attempt to add the account again.

Like, if everything fails, you could try using SSH, as it should be a highly reliable workaround. 👀

Cheers,
Tobi

[Tomislav Tobijas]

Side note - if you're connecting or authorizing to cloud environments, you can check/follow their status here: Atlassian Status (e.g., if you suspect there might be an issue with authorization on the Bitbucket side)

[Tomislav Tobijas]

ℹ️ I've reached out to the forum support team to potentially check if there's any global outage that might result in what you folks are experiencing. 

[Jeffrey Manalang]

I’m still getting a white page, especially when connecting via OAuth through the browser.

[Peter Gilchrist]

Same problem here .. i upgraded to 3.4.31 yesterday (latest windows version) yesterday .. came in today and can't authenticate status 500 error .. tried to create a new token no luck. Downgraded to 3.4.28 and that makes no difference

[Peter Gilchrist]

was about to log a ticket and saw this:

https://bitbucket.status.atlassian.com/incidents/h51sr145gsmx

[Peter Gilchrist]

Identified We have identified the likely cause of the issue, and our teams are diligently working on a mitigation. Affected users may experience OAuth login issues in Bitbucket. We will continue to share additional updates here as more information is available. Posted 12 minutes ago. Jun 11, 2026 - 23:21 UTC Investigating We are actively investigating reports of performance degradation affecting Bitbucket OAuth login. We will share updates here as more information is available. Posted 45 minutes ago. Jun 11, 2026 - 22:48 UTC

[Peter Gilchrist]

[Jeffrey Manalang]

thanks. It's working now

[Tomislav Tobijas]

Oh wow 👀 This was a really quick fix 😅

Thanks for sharing the incident link @Peter Gilchrist!