Bitbucket app password is being deprecated. Renovate to add support for Bitbucket API tokens.

[szhang1200]

Tell us more.

Bitbucket Cloud has announced they are deprecating app passwords. The Renovate bot uses Bitbucket app passwords to call Bitbucket APIs and perform git operations.

https://community.atlassian.com/forums/Bitbucket-articles/Deprecation-notice-Bitbucket-Cloud-shifts-to-API-tokens-from-app/ba-p/3040975#M2462

Bitbucket API tokens are personal access tokens designed to be long term replacement for app passwords.

There will be a 12 month deprecation period. On June 9, 2026 app passwords will stop working. I propose that Renovate adds the option to integrate via Bitbucket API tokens.

There are some differences in how API tokens will work compared to app passwords. For Bitbucket APIs, a basic auth with Atlassian email + API token is required. For git operations they require a static username x-bitbucket-api-token-auth + API token. See https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/

The proposal is to implement support for API tokens now. In 12 months time deprecate app passwords as an integration option. Would be great to get some ideas on this :)

[rarkins]

There's already some token support in the Bitbucket Cloud platform code in Renovate:

renovate/lib/modules/platform/bitbucket/index.ts

Lines 73 to 95 in 014eeba

	export async function initPlatform({
	endpoint,
	username,
	password,
	token,
	}: PlatformParams): Promise<PlatformResult> {
	if (!(username && password) && !token) {
	throw new Error(
	'Init: You must configure either a Bitbucket token or username and password',
	);
	}
	if (endpoint && endpoint !== BITBUCKET_PROD_ENDPOINT) {
	logger.warn(
	`Init: Bitbucket Cloud endpoint should generally be ${BITBUCKET_PROD_ENDPOINT} but is being configured to a different value. Did you mean to use Bitbucket Server?`,
	);
	defaults.endpoint = endpoint;
	}
	setBaseUrl(defaults.endpoint);
	renovateUserUuid = null;
	const options: HttpOptions = { memCache: false };
	if (token) {
	options.token = token;
	} else {

The x-bitbucket-api-token-auth part is new though. I wonder if any username actually works or we need to add logic here too:

renovate/lib/modules/platform/bitbucket/index.ts

Lines 256 to 258 in 014eeba

	const auth = opts.token
	? `x-token-auth:${opts.token}`
	: `${opts.username!}:${opts.password!}`;

[szhang1200]

For API tokens, it has to be either your bitbucket username, or the static username x-bitbucket-api-token-auth.

The x-token-auth is the access token auth (which is different from API tokens).

[rarkins]

Can renovate determine which type of token it is by looking at the token length or prefix?

[szhang1200]

Yes, a prefix of ATAT is API token, a prefix of ATCT is access token.

[rarkins]

Converted to issue: #36503