authentication failure with read-only access to repo

pcrooker

I'm trying to set up a developer to start work. I created a bitbucket account to test with, gave it read access to the repo which works - logging in on the test account I can access the repo. But when I try cloning the repo with git using https, that account authentication fails. If I use ssh it does work.

I have an ssh key installed in the workspace and I'm guessing that is the reason for the https connection failure. I went to workspace settings → ssh keys to try removing my key and it reports "There are no keys configured". This has happened previously a couple of times and I've added my key back and that worked. I'm thinking I could try adding the key again, then deleting it, but I've added a few other keys from previous computers over the years and they are probably still in there somewhere.

What to do? Is the auth failure actually because of the workspace ssh key? I can't, in any practical sense, require the devs to use ssh as this isn't a software project but a botany classification thing and they aren't going there - using vscode and git will be hard enough. Any help will be welcome.

EDIT: I tried adding the key again, it came back with: "Someone has already added that SSH key."

A A Ron Geister [Trundl]

Hey pcrooker,

Good news — this almost certainly isn't the SSH key, so you can stop chasing that one. (The "no keys configured" under workspace settings is just because personal SSH keys live under your personal account settings, not the workspace — totally separate thing, and not what's breaking your HTTPS clone.)

What's actually happening: as of June 9, 2026, Bitbucket fully retired app passwords and account-password login over HTTPS. HTTPS git now only authenticates with an API token that has repository scopes. SSH still works because the key is a separate auth path that was never affected — which is exactly why ssh succeeds and https fails for you.

The fix on your test/dev account:

1. Click the gear/cog → Atlassian account settings → Security → "Create and manage API tokens."
2. Choose "Create API token with scopes" and select Bitbucket.
3. For read-only cloning, tick read:repository:bitbucket. (Add write:repository:bitbucket too if they'll be pushing.)
4. Set an expiry, create it, and copy it — it's only shown once.

Then clone over HTTPS using the Bitbucket username (not the email) as the user and the API token as the password:

git clone https://<username>@bitbucket.org/<workspace>/<repo>.git

...and paste the token when it prompts for a password. In VS Code it'll prompt the same way, and the OS credential manager will remember it after the first time — so your botany folks don't have to touch ssh at all. 🙂

Docs if it helps: https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/

One gotcha to watch: a bare token with no scopes won't work for git — it has to be the "with scopes" one. Hope that gets them unblocked!

P.S. If you are setting up pipelines you can use a regular API token auth without scopes for each environment and a user account. My advice is to use a service account for this so its not tied to a dev account incase they ever are deactivated.