Atlassian announced that Bitbucket Cloud app passwords are replaced by API tokens with scopes and expiry dates. Its announcement set 9 September 2025 as the end of new app passwords and 9 June 2026 as the date they stop working. Any script or CI job still using one needs a scoped API token now.
What changed
Atlassian's announcement describes three dates. On 9 June 2025 it announced the change. From 9 September 2025 Bitbucket Cloud stopped allowing new app passwords while existing ones kept working. From 9 June 2026 app passwords stop working entirely, and integrations still using them fail unless switched to API tokens.
Other pages in the community have described brownout periods and a later final removal date, so the schedule may have moved. Whatever the exact day, today is past the original cutoff. If a job broke recently, an app password is a likely cause, so check Atlassian's current notice for your account.
Why the new model is safer
| Property | App password | API token with scopes |
|---|---|---|
| Scopes | Classic scopes | Modern identity scopes, described by Atlassian as more secure and flexible |
| Expiry | Not defined in the announcement | Set an expiry date when you create it |
| Management | Per user in personal settings | Managed centrally, and org admins of claimed domains can see usage and revoke |
An expiring token with narrow scopes limits the damage of a leak, and central visibility helps when someone leaves.
Migration steps
- List what uses app passwords. Check scripts, CI jobs, test setups, deployment tools, and Bitbucket-connected third party apps. Review the app passwords in your Bitbucket personal settings to see what exists.
- For each integration, decide the minimum scopes it needs, such as read access to repositories or write access to pull requests.
- Create the token: go to Atlassian account settings, Security, Create and manage API tokens, then Create API token with scopes. Name it, set an expiry date, select Bitbucket as the app, and assign permissions.
- Copy the token. It is shown only once.
- Update the integration and secret store. Name tokens after the job that uses them, so a compromised token can be revoked without hurting others.
- Test the job, then delete the old app password.
- Calendar the token expiry date and name an owner.
Gotchas
Third party sources report that Bitbucket API calls now expect the Atlassian account email as the identity, while Git operations still use the username. Check your tool's documentation, since this changes the stored credential format. Also ask each vendor whose product connects to Bitbucket whether it supports the new tokens, as Atlassian says it is working with partners but customers should still check their own integrations.
Prefer not to use user tokens at all
API tokens are still tied to a person. For automation, consider repository, project, or workspace access tokens, which are tied to a resource instead of a user. See Bitbucket token types compared. Within Bitbucket Pipelines, OIDC can remove stored cloud keys, as covered in this guide.
Quick check
Do API tokens expire?
You can set an expiry date when you create one. Atlassian's announcement does not give minimum or maximum limits.
Can I view an API token after creating it?
No. The token is shown once at creation, so store it in a secret manager straight away.
Safeguard can scan the repositories your integrations touch for dependency risk, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
