# How to rotate Bitbucket API and access tokens > Reissue a Bitbucket Cloud API token with scopes or a repository access token, now that app passwords no longer work, without breaking clones and pipelines. URL: https://crunu.com/rotate/bitbucket Language: en Updated: 2026-10-30 Create a new API token with the same Bitbucket scopes in your Atlassian account settings, put it everywhere Git and your scripts read the old one, check that a clone or a pipeline run works with it, then revoke the old token. An account can hold several API tokens at once, so the switch has an overlap and nothing has to fail. For a repository access token, Bitbucket also offers a rotate action that refreshes the secret and expiry date without redefining the scopes ([Bitbucket docs](https://support.atlassian.com/bitbucket-cloud/docs/repository-access-tokens/)). Crunu doesn't issue, rotate or revoke Bitbucket tokens. It shows which Bitbucket values someone could read before they left, stores the new token as a new environment version, and passes it to the jobs that need it. *Figure: Timeline of rotating the API token with scopes. Step 1: a new key is issued while the old one keeps working. Step 2: every place that uses the key is updated, with no downtime because both keys work. Step 3: the old key is revoked. After revocation the old key stops working at once.* ## App passwords are gone If your pipelines still mention an app password, that is the first thing to reissue. Bitbucket Cloud stopped creating new app passwords on September 9, 2025 ([Atlassian blog](https://www.atlassian.com/blog/bitbucket/bitbucket-cloud-transitions-to-api-tokens-enhancing-security-with-app-password-deprecation)). The original plan ended them on June 9, 2026. Atlassian later ran brownouts between June 9 and July 28, 2026, and says that after July 28 app passwords no longer work ([Atlassian support](https://support.atlassian.com/bamboo/kb/bitbucket-cloud-repository-configuration-fails-in-bamboo-with-api-tokens/)). The replacement is an API token with scopes. ## The two token families **API tokens with scopes** belong to an Atlassian account. Bitbucket calls them single-purpose tokens with scoped user access, fixed at creation ([using API tokens](https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/)). Tokens used for Bitbucket APIs or Git must have scopes: cloning needs `read:repository:bitbucket`, and pushing needs `write:repository:bitbucket` as well. For Git over HTTPS, the username is your Bitbucket username, case-sensitive, or the fixed value `x-bitbucket-api-token-auth`. For the REST API with basic authentication, it's your Atlassian account email. Bitbucket advises against keeping the token in a Git remote URL unless it's stored as a secret variable in a build tool. Atlassian sets the lifetime between 1 and 365 days, one year by default ([manage API tokens](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/)). Tokens created before December 15, 2024 were set to expire between March 14 and May 12, 2026, so long-lived tokens from that era have already stopped. **Repository, project and workspace access tokens** belong to the resource, not to a person. A repository access token reaches a single repository, can't manage workspaces or projects, can't be used to log in, and can't be viewed or edited after creation. It can have an expiry date and stops working when revoked. A workspace can require all access tokens to expire. For pipelines, access tokens tied to a repository are the steadier choice: no user account stands behind them, so treat them as valid after a departure and reissue them when the person could read them. ## Reissue an API token without downtime 1. In your Atlassian account settings, open **Security**, then create an API token with scopes. Name it, set the expiry, choose Bitbucket as the app and select the same scopes as the old token. Atlassian shows it once. 2. Store it in Crunu next to the username it pairs with, for example `BITBUCKET_API_TOKEN` in `web-app / production`. Saving produces a new environment version; the old value stays in its history. 3. Move every consumer. Scripts started with `crunu run --env web-app/production -- …` get the newest version on their next start, and long-running services restart themselves with `--restart on-change`. Update the Git credential helper on machines where people clone with the token. 4. Run a pipeline that clones or pushes with the new token, and a script that calls the API, and check both authenticate. 5. Revoke the old token on the same API tokens page. Atlassian says a revoked token no longer works and is removed permanently from the account. To clear every token of one account at once, Atlassian offers **Revoke all API tokens**. ## When to reissue - **A departure.** Their own API tokens act as their account, so ending their Atlassian and workspace access matters more than the tokens' expiry dates. Then reissue what they could read: repository and workspace access tokens, the token of a shared bot account, deploy credentials in pipeline variables. Removing the person in Crunu yields a reissue checklist with those values by name. - **A leak.** Revoke first, then issue the replacement. For a repository access token, rotating gives a new secret without rebuilding its permissions. - **Approaching expiry.** With a maximum of a year, every Bitbucket token is reissued at least annually, so a calendar reminder a few weeks ahead turns that into a planned switch. The full sequence for someone leaving is in [What to rotate when a developer leaves](https://crunu.com/guides/developer-offboarding-secret-rotation), and the [offboarding checklist](https://crunu.com/tools/offboarding-checklist) builds the list for your own tools. Crunu then records when the new Bitbucket value was saved and by whom; issuing and revoking the token stay in the Atlassian and Bitbucket settings. ## FAQ ### Can I still use a Bitbucket app password? No. Bitbucket Cloud stopped creating new app passwords on September 9, 2025. After brownouts between June 9 and July 28, 2026, Atlassian says app passwords no longer work. API tokens with scopes replace them for Git and the REST API. ### Which username goes with a Bitbucket API token? For Git over HTTPS, your Bitbucket username exactly as shown in your account settings, or the fixed value x-bitbucket-api-token-auth. For the REST API with basic authentication, your Atlassian account email. The token is the password in both cases. ### How long does an Atlassian API token last? You choose 1 to 365 days, and a new token expires in one year by default. Tokens created before December 15, 2024 were set to expire between March 14 and May 12, 2026. ### Does Crunu revoke Bitbucket tokens? No. Crunu doesn't call Bitbucket or Atlassian. It shows which Bitbucket values a departing person received, keeps the new token as a new environment version, and gives it to your jobs through crunu run. ## Sources - [Atlassian Support: Manage API tokens for your Atlassian account](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/) (accessed 2026-10-30) - [Bitbucket Cloud: Using API tokens](https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/) (accessed 2026-10-30) - [Bitbucket Cloud: Repository access tokens](https://support.atlassian.com/bitbucket-cloud/docs/repository-access-tokens/) (accessed 2026-10-30) - [Atlassian: Bitbucket Cloud transitions to API tokens](https://www.atlassian.com/blog/bitbucket/bitbucket-cloud-transitions-to-api-tokens-enhancing-security-with-app-password-deprecation) (accessed 2026-10-30) - [Atlassian Support: Bitbucket Cloud repository configuration fails in Bamboo with API tokens](https://support.atlassian.com/bamboo/kb/bitbucket-cloud-repository-configuration-fails-in-bamboo-with-api-tokens/) (accessed 2026-10-30)