App password doesn't work with REST API

[Marat Bakeev]

I can't get my app password to work with any API requests at all:

I'm entering my username from my profile page - <username>, and I've created an app password there. I'm trying to use `curl` with the simplest possible request:

curl --request GET --url 'https://api.bitbucket.org/2.0/repositories/workspace-id/repo/commits' --user '<username>:<REDACTED>' --header 'Accept: application/json'

All I'm getting to any API endpoints are:

Login failed due to incorrect login credentials or method.
For information on authentication methods for Bitbucket Cloud APIs, visit:
https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication
If you are unsure of which login details or login method to use, visit:
https://support.atlassian.com/bitbucket-cloud/docs/log-into-or-connect-to-bitbucket-cloud/

I'm obviously doing something wrong, but I can't figure out what.

I've tested the app password by pulling a repo - that works. The password has `read` and `write` permissions on all scopes.

[Theodora Boudale · Accepted solution]

Hi Marat and welcome to the community.

Could you please run the curl command with the argument -v

curl -v --request GET --url 'https://api.bitbucket.org/2.0/repositories/workspace-id/repo/commits' --user 'username:app-password' --header 'Accept: application/json'

and then copy-paste the command and output here? This will show more verbose output and possibly an indication of what may be going wrong.

Please make sure to sanitize the following info in the output prior to posting it here:

• The line that starts with > authorization: in the output shows credential info. Please make sure to replace that with a dummy value prior to sharing.
• The workspace-id and repo slug also show in the output, make sure to replace these values as well.

Just a heads up, I removed the username, workspace id, and repo name to comply with our privacy policy.

Kind regards,
Theodora

[Marat Bakeev]

Hi Theodora, thank you - here's the sanitized output:

❯ curl -v --request GET --url 'https://api.bitbucket.org/2.0/repositories/<workspaceid>/<repository>/commits' --user '<username>:<APPPW>' 

--header 'Accept: application/json' 

Note: Unnecessary use of -X or --request, GET is already inferred.

* Trying 104.192.141.1:443...

* Connected to api.bitbucket.org (104.192.141.1) port 443 (#0)

* ALPN: offers h2

* ALPN: offers http/1.1

* CAfile: /etc/ssl/certs/ca-certificates.crt

* CApath: none

* TLSv1.0 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (OUT), TLS header, Finished (20):

* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Finished (20):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, CERT verify (15):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Finished (20):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.3 (OUT), TLS handshake, Finished (20):

* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256

* ALPN: server accepted h2

* Server certificate:

* subject: C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; CN=*.bitbucket.org

* start date: Jul 1 00:00:00 2022 GMT

* expire date: Jul 21 23:59:59 2023 GMT

* subjectAltName: host "api.bitbucket.org" matched cert's "*.bitbucket.org"

* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA

* SSL certificate verify ok.

* Using HTTP2, server supports multiplexing

* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* Server auth using Basic with user '<username>'

* h2h3 [:method: GET]

* h2h3 [:path: /2.0/repositories/<workspace-id>/<repository>/commits]

* h2h3 [:scheme: https]

* h2h3 [:authority: api.bitbucket.org]

* h2h3 [authorization: Basic REDACTED]

* h2h3 [user-agent: curl/7.86.0]

* h2h3 [accept: application/json]

* Using Stream ID: 1 (easy handle 0x560b99a28e60)

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

> GET /2.0/repositories/<workspace-id>/<repository>/commits HTTP/2

> Host: api.bitbucket.org

> authorization: Basic REDACTED

> user-agent: curl/7.86.0

> accept: application/json

> 

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* Connection state changed (MAX_CONCURRENT_STREAMS == 200)!

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

< HTTP/2 401 

< content-security-policy-report-only: base-uri 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website

< server: envoy

* Authentication problem. Ignoring this.

< www-authenticate: Basic realm="Bitbucket.org HTTP"

< vary: Accept-Language, Origin

< content-type: text/plain

< x-b3-traceid: a60e46480c01fc99

< x-usage-output-ops: 0

< x-used-mesh: None

< x-dc-location: Micros-3

< strict-transport-security: max-age=31536000; includeSubDomains; preload

< date: Tue, 15 Nov 2022 01:56:12 GMT

< x-usage-user-time: 0.014949

< x-usage-system-time: 0.000000

< x-served-by: a0a48eaa1f79

< x-envoy-upstream-service-time: 23

< content-language: en

< x-static-version: bce06ab6adb4

< etag: "a9adbb963b9b4ff0454b469abbbc002a"

< x-render-time: 0.013782739639282227

< x-usage-input-ops: 0

< x-frame-options: SAMEORIGIN

< x-version: bce06ab6adb4

< x-request-count: 452

< content-length: 380

< 

Login failed due to incorrect login credentials or method.

For information on authentication methods for Bitbucket Cloud APIs, visit:

https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication

If you are unsure of which login details or login method to use, visit:

https://support.atlassian.com/bitbucket-cloud/docs/log-into-or-connect-to-bitbucket-cloud/

* Connection #0 to host api.bitbucket.org left intact

```

Just to double check - I was able to clone the same repository using this exact username and app password.

[Theodora Boudale]

Hi Marat,

Thank you for the info.

I see in the output of the call HTTP/2 401, which indicates an unauthorized request.

The username you mentioned in your first post (prior to my editing) is correct for your account.

• When you use the app password in the call, can you please confirm that you are not enclosing it in the characters < and > ?
  
  
• Are you using a terminal application to run this API call? I checked our logs for API requests to the commits of this specific repo (mentioned in your first post). I see a few unauthenticated ones, but they don't seem to come from curl.
  
  
• For testing purposes, can you please generate a new app password with at least Repositories: Read permissions, try running the curl command again from a terminal with the new app password, and the same repo, and let me know what the output is then?

Kind regards,
Theodora

[Marat Bakeev]

Hi Theodora, sorry for the delay, I hope you can still help me.

* I confirm that I'm not using <> in the password

* I'm just trying to use curl, and my next step would be a python script.

* I've created new password (test4):

I've tried it with both my personal repo and the group repo - I'm getting same 401 error:

❯ curl -v --request GET --url 'https://api.bitbucket.org/2.0/repositories/<workspace-id>/<repo-slug>/commits' --user '<username>:REDACTED' --header 'Accept: application/json'

Note: Unnecessary use of -X or --request, GET is already inferred.

* Trying 104.192.141.1:443...

* Connected to api.bitbucket.org (104.192.141.1) port 443 (#0)

* ALPN: offers h2

* ALPN: offers http/1.1

* CAfile: /etc/ssl/certs/ca-certificates.crt

* CApath: none

* TLSv1.0 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (OUT), TLS header, Finished (20):

* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Finished (20):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, CERT verify (15):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Finished (20):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.3 (OUT), TLS handshake, Finished (20):

* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256

* ALPN: server accepted h2

* Server certificate:

* subject: C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; CN=*.bitbucket.org

* start date: Jul 1 00:00:00 2022 GMT

* expire date: Jul 21 23:59:59 2023 GMT

* subjectAltName: host "api.bitbucket.org" matched cert's "*.bitbucket.org"

* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA

* SSL certificate verify ok.

* Using HTTP2, server supports multiplexing

* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* Server auth using Basic with user 'mtb-srcd'

* h2h3 [:method: GET]

* h2h3 [:path: /2.0/repositories/<workspace-id>/<repo-slug>/commits]

* h2h3 [:scheme: https]

* h2h3 [:authority: api.bitbucket.org]

* h2h3 [authorization: Basic REDACTED

* h2h3 [user-agent: curl/7.86.0]

* h2h3 [accept: application/json]

* Using Stream ID: 1 (easy handle 0x562c00d99e60)

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

> GET /2.0/repositories/<workspace-id>/<repo-slug>/commits HTTP/2

> Host: api.bitbucket.org

> authorization: Basic REDACTED

> user-agent: curl/7.86.0

> accept: application/json

>

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* Connection state changed (MAX_CONCURRENT_STREAMS == 200)!

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

< HTTP/2 401

< content-security-policy-report-only: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; object-src 'none'; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com stats.g.doubleclick.net sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website

< server: envoy

* Authentication problem. Ignoring this.

< www-authenticate: Basic realm="Bitbucket.org HTTP"

< vary: Accept-Language, Origin

< content-type: text/plain

< x-b3-traceid: ef081a7d2dc4ef53

< x-usage-output-ops: 0

< x-used-mesh: None

< x-dc-location: Micros-3

< strict-transport-security: max-age=31536000; includeSubDomains; preload

< date: Mon, 28 Nov 2022 03:39:50 GMT

< x-usage-user-time: 0.013505

< x-usage-system-time: 0.004352

< x-served-by: 767bd36a3834

< x-envoy-upstream-service-time: 29

< content-language: en

< x-static-version: 979082ecfb45

< etag: "a9adbb963b9b4ff0454b469abbbc002a"

< x-render-time: 0.017920255661010742

< x-usage-input-ops: 0

< x-frame-options: SAMEORIGIN

< x-version: 979082ecfb45

< x-request-count: 666

< content-length: 380

<

Login failed due to incorrect login credentials or method.

For information on authentication methods for Bitbucket Cloud APIs, visit:

https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication

If you are unsure of which login details or login method to use, visit:

https://support.atlassian.com/bitbucket-cloud/docs/log-into-or-connect-to-bitbucket-cloud/

* Connection #0 to host api.bitbucket.org left intact

❯ curl -v --request GET --url 'https://api.bitbucket.org/2.0/repositories/<workspace-id>/<repo-slug>/commits' --user '<username>:REDACTED' --header 'Accept: application/json'

Note: Unnecessary use of -X or --request, GET is already inferred.

* Trying 104.192.141.1:443...

* Connected to api.bitbucket.org (104.192.141.1) port 443 (#0)

* ALPN: offers h2

* ALPN: offers http/1.1

* CAfile: /etc/ssl/certs/ca-certificates.crt

* CApath: none

* TLSv1.0 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (OUT), TLS header, Finished (20):

* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS header, Finished (20):

* TLSv1.2 (IN), TLS header, Certificate Status (22):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, CERT verify (15):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Finished (20):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.3 (OUT), TLS handshake, Finished (20):

* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256

* ALPN: server accepted h2

* Server certificate:

* subject: C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; CN=*.bitbucket.org

* start date: Jul 1 00:00:00 2022 GMT

* expire date: Jul 21 23:59:59 2023 GMT

* subjectAltName: host "api.bitbucket.org" matched cert's "*.bitbucket.org"

* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA

* SSL certificate verify ok.

* Using HTTP2, server supports multiplexing

* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* Server auth using Basic with user 'mtb-srcd'

* h2h3 [:method: GET]

* h2h3 [:path: /2.0/repositories/<workspace-id>/<repo-slug>/commits]

* h2h3 [:scheme: https]

* h2h3 [:authority: api.bitbucket.org]

* h2h3 [authorization: Basic REDACTED

* h2h3 [user-agent: curl/7.86.0]

* h2h3 [accept: application/json]

* Using Stream ID: 1 (easy handle 0x55e8598c4e60)

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

> GET /2.0/repositories/<workspace-id>/<repo-slug>/commits HTTP/2

> Host: api.bitbucket.org

> authorization: Basic REDACTED

> user-agent: curl/7.86.0

> accept: application/json

>

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

* Connection state changed (MAX_CONCURRENT_STREAMS == 200)!

* TLSv1.2 (OUT), TLS header, Supplemental data (23):

* TLSv1.2 (IN), TLS header, Supplemental data (23):

< HTTP/2 401

< content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com stats.g.doubleclick.net sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website

< server: envoy

* Authentication problem. Ignoring this.

< www-authenticate: Basic realm="Bitbucket.org HTTP"

< vary: Accept-Language, Origin

< content-type: text/plain

< x-b3-traceid: 999a132b8034e679

< x-usage-output-ops: 0

< x-used-mesh: None

< x-dc-location: Micros-3

< strict-transport-security: max-age=31536000; includeSubDomains; preload

< date: Mon, 28 Nov 2022 03:42:33 GMT

< x-usage-user-time: 0.014008

< x-usage-system-time: 0.000000

< x-served-by: f68fc53bb2c7

< x-envoy-upstream-service-time: 22

< content-language: en

< x-static-version: 979082ecfb45

< etag: "a9adbb963b9b4ff0454b469abbbc002a"

< x-render-time: 0.012450456619262695

< x-usage-input-ops: 0

< x-frame-options: SAMEORIGIN

< x-version: 979082ecfb45

< x-request-count: 1923

< content-length: 380

<

Login failed due to incorrect login credentials or method.

For information on authentication methods for Bitbucket Cloud APIs, visit:

https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication

If you are unsure of which login details or login method to use, visit:

https://support.atlassian.com/bitbucket-cloud/docs/log-into-or-connect-to-bitbucket-cloud/

* Connection #0 to host api.bitbucket.org left intact

[Theodora Boudale]

Hi @Marat Bakeev,

Thank you for the info. I suspect that the issue may have to do with some changes we made to our API, I will reach out to the development team to find out if we need any further info to debug this and how to resolve this. I will let you know as soon as I have an update.

Kind regards,
Theodora

[Dan Fraser]

Hey @Marat Bakeev,

From what we can see of the curl traces you provided, your PC appears to return an incorrect IP address when doing the DNS lookup of `api.bitbucket.org`. You'll notice in your trace it shows this line `* Trying 104.192.141.1:443...`

Authoritative nameservers for bitbucket.org will return 18.205.93.8,6,7  for api.bitbucket.org as you can see in the below dns trace:

> dig api.bitbucket.org +trace @8.8.8.8
...
api.bitbucket.org. 60 IN A 18.205.93.8
api.bitbucket.org. 60 IN A 18.205.93.6
api.bitbucket.org. 60 IN A 18.205.93.7

`104.192.141.1` is not in any public resolver / nameserver for that specific domain.

Can you please inspect any hosts file, dns proxy or dns server you operate to see if it might be overriding the public record?

Thanks,

@Dan Fraser 

[Marat Bakeev]

Hey @Dan Fraser , thank you very much, that was it. For some reason I've overridden *.bitbucket.org with that IP, I think I had IPv6 issues I was trying to solve. Thank you for your help

[Theodora Boudale]

Thank you for the update @Marat Bakeev, it's good to hear that the issue is resolved!

And thank you @Dan Fraser as well for looking into this!