Bitbucket Cloud app passwords: July 28, 2026 removal deadline

Who is affected

Developers, CI/CD pipelines, and integrations authenticating to Bitbucket Cloud repositories with app passwords over HTTPS or the REST API.

Admin roles to involve: Atlassian admin, DevOps/CI owners, Repository admins

What administrators should do

Replace every remaining Bitbucket Cloud app password with a scoped API token (Atlassian account settings > Security > Create and manage API tokens > Create API token with scopes) and update Git credentials, CI/CD pipelines, backup tools, and integrations that authenticate with them. Atlassian's published timeline: the deprecation was announced on June 9, 2025; creation of new app passwords was disabled from September 9, 2025; brownouts were scheduled from June 9 to July 27, 2026; and final removal was set for July 28, 2026, the date from which Atlassian said app-password authentication would be permanently disabled (Atlassian changelog entry CHANGE-3222). Atlassian said that during each brownout window REST API requests authenticated with an app password fail with HTTP 401 and Git-over-HTTPS operations fail with HTTP 410. Atlassian has not published a separate notice confirming the removal was completed, so treat July 28, 2026 as the announced deadline and assume any credential that is still an app password no longer works.

What happens if this is ignored

Under Atlassian's schedule, clones, pushes, API calls, and integrations that still authenticate with app passwords stop working, breaking builds, deployments, and backups.