authentication using app password failing since 4 hours ago
Asked by Alan Casalboni:

I'm using wget or cURL to download resources from bitbucket repositories.

Starting from March, 10th 6:00PM GMT I'm receiving this message:

Bitbucket Cloud recently stopped supporting account passwords for API authentication.  
See our community post for more details: <https://atlassian.community/t5/x/x/ba-p/1948231>  
App passwords are recommended for most use cases and can be created in your Personal settings:  
<https://bitbucket.org/account/settings/app-passwords/>  
For more details on API authentication methods see our documentation:  
<https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication>

even if using username (not email) + app password, both with Basic Authentication Header or username:apppassword

app password has been created with all the available permissions checked.


Answers:
author: Alan Casalboni
body: actually resolved by changing the host from

<https://bitbucket.org/company/repo/download/resource>

to

<https://api.bitbucket.org/2.0/repositories/company/repo/download/resource>

basic authentication still functional using api url.


author: seth_reeser
body: Figured out how basic authentication still works through cURL, Wget or similar.

Use your username and then create an App password here: <https://bitbucket.org/account/settings/app-passwords/>

This was discovered by an API response with this message:

```
See our community post for more details: https://atlassian.community/t5/x/x/ba-p/1948231

App passwords are recommended for most use cases and can be created in your Personal settings:

https://bitbucket.org/account/settings/app-passwords/

For more details on API authentication methods see our documentation:

https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication
```


author: volkerrose
body: There must have been a change in the basic auth authentication part of the API. As the others here also noted, requests via basic auth started failing for me in the last weeks.

The answer over at <https://community.atlassian.com/t5/Bitbucket-questions/Re-How-use-List-Pull-Requests-API-with-App-Passwords-an/qaq-p/1971625/comment-id/79503#M79503> did give me the solution.

> \[...\] to use app passwords in basic auth, the username you'd use is your **Bitbucket username \[...\]**

I was using my **email address** in combination with the app password before. As soon as I changed it to **username** plus app password the requests were successful again.

comments: author: villeviitaharju
body: > I was using my **email address** in combination with the app password before. As soon as I changed it to **username** plus app password the requests were successful again.

Don't know if they fixed that already, but it didn't work with username or email when I last time answered this thread.  

My original code was using username for that since the beginning. My current oauth method seems to be stable now also.


author: Alan Casalboni
body: seems that User-Agents "curl" and "wget" has been blacklisted

comments: author: villeviitaharju
body: Even postman throws you error if you have 'Authorization' header with 'Basic bearer' included. Without word 'Basic' we get HTML page.  

User-agent doesn't seem to matter as it also has 'User-agent': 'PostmanRuntime/7.29.0'  

<br />

Error we got in postman:  

Error: Exceeded maxRedirects. Probably stuck in a redirect loop <https://bitbucket.org/account/signin/?next=>...  


author: Alan Casalboni
body: if you override User-Agent header set to 'curl' or 'wget' you will see the same error when using curl (or wget)


author: villeviitaharju
body: Good point, totally missed that one..  

So other user agents just go to redirect loop while wget/curl show error (but are both broken).


author: villeviitaharju
body: Same issue here (using node request instead of curl, but same method with basic auth).  

And when using CURL, it response shows app password error while using app password.

comments: author: villeviitaharju
body: Update:  
Changed our code to use OAuth instead of basic auth.  
So instead of one simple step, we had to do multiple steps to archieve the same results..


author: Alan Casalboni
body: So using OAuth works?


author: villeviitaharju
body: Yep, OAuth works. But it is just much more work compared to basic auth.


Tags: bitbucket-cloud

cloud