Repository navigation
[Refactor][Bitbucket] Support Bitbucket API tokens in place of App passwords #8520
Description
What and why to refactor
Currently, the Bitbucket plugin in Apache DevLake relies on “App passwords” for authentication to Bitbucket Cloud. Bitbucket has announced that on September 9, 2025, creation of App passwords will be discontinued, and on June 9, 2026, all existing App passwords will be deactivated. After these dates, any DevLake connections using App passwords will break and fail to sync Bitbucket data.
To ensure uninterrupted operation and long-term support for Bitbucket integrations, we need to refactor the plugin to support the new Bitbucket API tokens authentication mechanism.
Describe the solution you’d like
- Support API token authentication
- Add a new authentication mode in the Bitbucket connector configuration to accept API tokens in lieu of App passwords.
- Update the DevLake client library to include the
Authorization: Bearer <API_TOKEN>header when connecting to Bitbucket Cloud.
- Migration path and validation
- Detect at runtime which credential type is provided (App password vs. API token) and validate accordingly.
- Provide clear error messages if an App password is used post-deprecation or if an API token lacks required scopes.
- Documentation updates
- Revise the “Connecting Bitbucket” docs to walk users through generating API tokens, the required scopes (Account:Read, Workspace membership:Read, Repositories:Read, Projects:Read, Pull requests:Read, Issues:Read, Pipelines:Read, Runners:Read), and updating their DevLake blueprint.
- Backward compatibility and defaults
- Preserve existing App password support until June 9, 2026 but display deprecation warnings in logs and the UI.
- Default new installations to require API tokens only.
Related issues
None
Additional context
Bitbucket’s in-product warning when creating App passwords:
Activity
klesh commentedon Aug 4, 2025
LGTM.
Are you going to work on it? I can assign the issue to you if you do.
sanjeevpenupala commentedon Aug 4, 2025
@klesh I would love to give it a shot, but unfortunately I don't have time in the near future to do so.
klesh commentedon Aug 5, 2025
I see. Thanks for the quick response.
sanjeevpenupala commentedon Sep 30, 2025
@klesh You can assign this ticket to me. I'll give it a shot.
test(bitbucket): add unit tests for API token authentication and conn…
klesh commentedon Oct 9, 2025
Sorry for late response, just got back from holidays.
Thanks for taking the ticket, happy coding. 💪
klesh commentedon Oct 9, 2025
To move forward more quickly, you could pull in the relevant changes from @petkostas 's PR #8599 to update the Go versions in your own branch.
sanjeevpenupala commentedon Oct 9, 2025
@klesh Will do. I left some comments on issues I was facing with @petkostas's PR.
I will wait for them to respond to it.
petkostas commentedon Oct 10, 2025
Thanks @spenpal I have updated the PR bumping Go to
v1.23GChannon commentedon Oct 28, 2025
When will you release the bitbucket token changes?
sanjeevpenupala commentedon Oct 29, 2025
@GChannon Hey, I'm primarily waiting for @petkostas's PR (#8599) to be merged first, so I can pull in those changes, since it is a pretty big Go version upgrade and will probably result in a lot of linting issues from the code I wrote.
fix(lint): resolve multiple linting issues
Merge branch 'main' into refactor/apache#8520-bitbucket-api-token
GChannon commentedon Nov 3, 2025
Are these changes in master?
sanjeevpenupala commentedon Nov 4, 2025
@GChannon
Yes, @klesh merged to the main branch.
GChannon commentedon Nov 5, 2025
Is it possible to add it to the latest beta release?
The latest docker image doesn’t contain the changes.
sanjeevpenupala commentedon Nov 6, 2025
@klesh would be able to answer that, as they are a maintainer for this project.
GChannon commentedon Nov 6, 2025
@klesh Can we get this into a beta version so I can test?
feat(bitbucket): add API token authentication support and deprecate A… (