Bitbucket deprecated App Passwords

Bitbucket announced that they deprecated app passwords in favor of their new API token system. This change affects organizations using Private Packagist with Bitbucket Cloud (bitbucket.org) workspace synchronizations. Bitbucket app passwords will stop working entirely on June 9th, 2026.

Bitbucket's app passwords provided limited functionality and security features. API tokens provide a more secure authentication method, increased admin flexibility, and additional expiry controls.

We recommend switching your existing Bitbucket App Password credentials to API Tokens as soon as possible to prevent interruptions in the future.

Migration steps

Create a New Bitbucket API Token Credential

1. Go to your organization's Credentials page
2. Set the "Authentication type" to "Bitbucket API token" in the "Add New Credentials" form
3. When creating your Bitbucket API token, ensure you include all the required scopes as shown in Private Packagist's credential form
4. Enter your new Bitbucket API token and complete the form

Replace Your Old App Password

1. From your organization's Credentials page, delete the old "Bitbucket Workspace Sync" app password
2. When prompted, select your new Bitbucket API token credential as the replacement.
3. This will automatically update all packages and synchronizations that were using the old credential

Test Your Synchronization

1. Navigate to your Synchronizations page in your organization
2. Click the context menu (three dots) in the Action column for your Bitbucket synchronization
3. The synchronization will automatically run again. Go to its Details page to verify that the synchronization run succeeded using the new API Token

Need Help?

If you encounter any issues during migration or have questions about the required scopes, our support team is here to help. Get in touch via contact@packagist.com or the support chat!