Topic hub

Bitbucket

Authentication, credentials and the app password deadline.

§01

What this covers

App passwords are going away, and the deadline is the least interesting part. The awkward part is that git does not tell you when a credential has stopped working — it only forgets one on a 401, so a token that quietly expired shows up as a repository that seems to have moved. Three pieces here: what actually breaks and why the obvious fix does not, how to move onto the replacement without breaking every working copy on the team, and why CHANGE-3222 will sit in your instance until somebody goes and clears it by hand.

§02

Series

Read in order

The Bitbucket app password deadline

3 parts

Diagnosing what the removal actually breaks, moving off it without breaking git, and clearing the warning that stays behind.

§03

Everything on this topic

Articles

3

ArticleBitbucket

CHANGE-3222 will not clear itself: git forgets a credential on 401, and Bitbucket answers 410

You swapped the app password for an API token and Bitbucket still says app passwords are deprecated. The token is not the problem and neither are its scopes. Git is re-sending the dead credential because git only erases a stored credential on a 401, and the status code Bitbucket chose for this is 410. I measured which codes clear a credential and which do not, on git 2.50.1, against both the store helper and the macOS keychain.

Aug 7, 202616 min read

TutorialBitbucket

How to Migrate Off Bitbucket App Passwords Without Breaking Git (2026)

A working migration: find what is still using an app password when Bitbucket gives you no report, pick the right credential for each consumer, prove the new token works before you cut over, and purge the cached credential that silently keeps sending the old one.

Jul 22, 202614 min read

ArticleBitbucket

Bitbucket App Passwords: What Actually Breaks, and Why Your Fix Didn't Work (2026)

App passwords are removed on 28 July 2026, and in the final week they were already dark 20 hours out of every 24. Here is the failure signature, the three different usernames nobody can keep straight, why swapping in a token often changes nothing, and the reason almost no team can tell you who is still affected.

Jul 22, 202613 min read