ST-2026-121 · Authentication & identity
Bitbucket Cloud enforces OAuth and API authentication contract changes
Bitbucket Cloud removed several OAuth behaviours on 4 May 2026: www.bitbucket.org API requests and body/query access tokens return 401, client credentials omit refresh tokens and token responses use scope.
Previous state
Some integrations sent OAuth-authenticated API requests to www.bitbucket.org, placed access tokens in query parameters or bodies, expected refresh tokens from client credentials or parsed scopes.
Current state
Those requests fail or return the revised token contract; access-token minting remains at https://bitbucket.org/site/oauth2/access_token and API requests must use supported hosts and Authorization headers.
Affected users
Who needs to care
Bitbucket Cloud OAuth integrations using the removed host, token-placement, refresh-token or plural scopes behaviours.
Required response
What to do
Use the supported API host and Bearer header, stop expecting client-credentials refresh tokens and parse the singular scope property.
Evidence boundary
What the source does not prove
This is one bundled OAuth enforcement family and is separate from Bitbucket app-password retirement, whose chronology was held for recovery.
Lifecycle history
Dated event sequence
- Brownout schedule announced
Atlassian documented two weeks of progressive brownouts.
- Brownouts began
The removed OAuth behaviours began failing during controlled windows.
- Final removal
The OAuth and API authentication changes became permanent.
Evidence ledger
First-party sources
- 01Atlassian Developer — Bitbucket Cloud changelog
Official authentication changelog · 2026-04-08
Open official source ↗