x401 Error while uploading the code

Rahul_2is1ox

 

Hello everyone,

I’m running into an issue with Bitbucket Cloud authentication that I haven’t been able to resolve even after following the official API token documentation.

❗ Problem Summary

I have an automation agent (Python) that uploads Terraform files into a Bitbucket Cloud repository using the REST API endpoint:

 

<span>POST <a href="https://api.bitbucket.org/2.0/repositories/" rel="noopener nofollow noreferrer" target="_blank">https://api.bitbucket.org/2.0/repositories/</a><workspace>/<repo>/src </span>

 

This upload used to work in a previous Bitbucket workspace using a Bitbucket App Password with Basic Auth (username:app-password).

However, in a new workspace/repository, all authentication attempts now fail with HTTP 401 Unauthorized, even though the same code and same method still work elsewhere.

🧪 What I have tested

1. Basic Auth with Bitbucket username + App Password

 

<span>curl -u "myuser:my_app_password" <a href="https://api.bitbucket.org/2.0/user" rel="noopener nofollow noreferrer" target="_blank">https://api.bitbucket.org/2.0/user</a> </span>

 

Result → 401 Unauthorized
(Same command succeeds in my older workspace)

2. Basic Auth with Atlassian email + App Password or API token

 

<span>curl --user "myemail@company.com:my_token" \ <a href="https://api.bitbucket.org/2.0/repositories/" rel="noopener nofollow noreferrer" target="_blank">https://api.bitbucket.org/2.0/repositories/</a><workspace>/<repo>/commits </span>

 

Result → 401 Unauthorized

3. Bearer token

 

<span>curl -H "Authorization: Bearer <token>" <a href="https://api.bitbucket.org/2.0/user" rel="noopener nofollow noreferrer" target="_blank">https://api.bitbucket.org/2.0/user</a> </span>

 

Result → 401 Unauthorized

4. Token types tested

• Bitbucket App Password

• Bitbucket API Token
  Both behave the same.

5. Token scopes

Tokens were created with:

• Repository: Read

• Repository: Write

• Account Read

6. Environment confirms variables are loaded correctly

Printing environment variables inside the agent shows correct username/token.

7. Repo/workspace name verified (case-sensitive)

Despite this, every authentication attempt in this specific workspace returns 401.

📌 Observed Behavior

Bitbucket responds with:

 

<span>HTTP/2 401 www-authenticate: BitbucketCustom realm=Bitbucket.org HTTP </span>

 

or for OAuth-style tokens:

 

<span>"Token is invalid, expired, or not supported for this endpoint." </span>

Even though the token(s) were freshly regenerated.

What makes this odd

• Using the same credentials locally works for Git clone.

• Using the same pattern of API call works for another workspace.

• Only the REST API authentication fails in the new workspace.

What I’m trying to confirm

• Are App Passwords or API Tokens still supported for uploading files via:

  <span>POST /2.0/repositories/{workspace}/{repo}/src </span>

  in all workspaces?

• Is there a workspace/org setting that could silently block token-based REST authentication?

• Is there a way to debug why Bitbucket rejects the token (e.g., audit logs, access logs)?

• Is this known behavior when Atlassian Access or SSO is enabled?

Request for help

If anyone has encountered App Password / API Token 401 failures only for REST API calls, especially with:

• Workspace-level security

• Atlassian Access

• SSO restrictions

• Specific repo permission models

Thanks in advance!

Alexander Nilsson

Hi Rahul,

 

Thanks for the detailed description — that’s very helpful.

To confirm, Bitbucket Cloud still supports App Passwords for REST API authentication, including file uploads using:

 

POST /2.0/repositories/{workspace}/{repo}/src

 

However, a 401 Unauthorized specific to a new workspace usually points to one of the following causes:

 

1. Workspace and Repository Permissions

 

App Passwords only carry the permissions of the user who created them. Please verify that the account has write or admin access to the target repository. You can check this with:

 

curl -u "username:app_password" https://api.bitbucket.org/2.0/user/permissions/repositories

 

2. SSO or Atlassian Access Enforcement

 

If the new workspace belongs to an organization where SSO is enforced through Atlassian Access, App Passwords (and API tokens) are disabled for managed accounts. In this case, only OAuth 2.0 authentication via an OAuth consumer or Connect app will work.

You can review authentication policies at admin.atlassian.com → Security → Authentication policies.

 

3. Username vs. Email

 

When using App Passwords, authentication must use your Bitbucket username, not your Atlassian email address.

You can confirm your username here: https://bitbucket.org/account/settings/.

 

4. API Token Limitation

 

Bitbucket Cloud does not support Atlassian API tokens for REST API access — only App Passwords. Using an API token will always return 401 Unauthorized.

 

Recommended Steps

 

• Confirm SSO enforcement status for the workspace.
• Regenerate a new App Password under an account with repository write access.
• Authenticate using username:app_password (not email).
• If SSO is required, migrate to OAuth 2.0 authentication.

If none of these apply, please raise a ticket with Atlassian Support so they can verify workspace-level authentication behavior directly:

https://support.atlassian.com/contact

Greetings,

Alex