using app passwords for api call authentications for bitbucket cloud

[Doug Shawhan]

I am attempting to access the bitbucket cloud REST api with the python requests module to list pull requests using an app password.

Docs at https://developer.atlassian.com/cloud/bitbucket/rest/intro/#basic-auth state the following regarding app passwords:

> Basic HTTP Authentication as per RFC-2617 (Digest not supported). Note that Basic Auth is available only with username and app password as credentials.

> - You can use them for API call authentication, even if you don't have two-step verification enabled.

I am unable to find any examples of how the app password is used. Since I am reduced to guessing, I have tried:

1.  the basic auth pattern using my username and the app password, which throws a deprecation warning

2. using the app password as an api token, which gives me a "token expired" message

Is there an example somewhere?

[Doug Shawhan · Accepted solution]

    def get_pull_request_data(self):

        user_name = self.config["DEFAULT"].get("user_name")
        app_password = self.config["DEFAULT"].get("app_password")
        api_url = self.config["DEFAULT"].get("api_url")
        workspace = self.config["DEFAULT"].get("workspace")
        repo_slug = self.config["DEFAULT"].get("repo_slug")

        query = f"{api_url}/2.0/repositories/{workspace}/{repo_slug}/pullrequests"
        headers = {
            "Accept": "application/json",
        }
        auth = (
            user_name,
            app_password,
        )

        response = requests.request("GET", query, headers=headers, auth=auth)
        response.raise_for_status()
        return response.json()

Well, it works now. Perhaps the app_password was not available to the api immediately after I created it. Mysteries.

[sriprasanna.mg]

Hi,

In our bitbucket data center instance we have disable basic auth for rest api calls. 

With that setting, we cannot use this approach

auth = (
            user_name,
            app_password,
        )

Because we get "basic authentication disable' error message,

So how can we use the app password when basic auth is disabled?

We tried with Bearer token: but it does not work as the authentication fails.

Any help?

[sriprasanna.mg]

Got blinded by cookies based auth (postman).

Present situation: Can't get auth. to work for rest api calls when basic auth is disabled