Cloning a repository using OAuth key and secret
Asked by Franz Holzinger:

In connection with a DDEV shell I need to use a clone command in the same way at it is done with personal access tokens in this documentation:  

<https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html>

```
git clone --mirror -- 'https://myOAuthKey:myOAuthSecret@bitbucket.org/myaccount/my_software.git' '/mnt/ddev-global-cache/composer/vcs/https---myaccount-bitbucket.org-myaccount-my-software.git/'
```

<br />

At the moment it ends up in an error message:

```

remote: Invalid username or password 
fatal: Authentication failed for 'https://myOAuthKey:myOAuthSecret@b 
itbucket.org/myaccount/my_software.git/'
```

However the key and secret are identical to those set for an OAuth consumer of this account's working space settings.

<br />

What must I do to make this working?  


Answers:
author: Theodora Boudale
body: Hi Franz and welcome to the community.

The documentation you included in your post is for Bitbucket Server access tokens. Based on the clone URL, it looks that you are using Bitbucket Cloud instead (repo hosted on bitbucket.org) so that documentation is not applicable.

If you are looking to authenticate with something similar like Bitbucket Server personal access tokens, you can check Bitbucket Cloud app passwords:

* <https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/>

You can generate an app password for your Bitbucket Cloud account, and use it instead of the account's password when you clone.

You can also use OAuth, however, the process is a little more complex.

The key and secret of an OAuth consumer can be used to generate an access token, and it is this access token that should be used in the clone command. The documentation for OAuth in Bitbucket Cloud can be found here:

* <https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/>

I am explaining below the steps you can follow in order to clone using OAuth:

**1.** While you are logged in to Bitbucket, go to your avatar \> **All workspaces** \> select the workspace you want to generate an OAuth consumer for.

After you open the workspace, go to its **Settings** from the sidebar \> **OAuth consumers** \> **Add consumer**.

Provide a name and Permissions for the consumer (if you only want to clone, then Repositories:Read should be enough).  
You can use as **Callback URL** <http://localhost>.  
Save the new consumer.

**2.** Open a new tab/window in your browser and navigate to the following URL (replace {consumer_key} with the consumer key that was generated, no brackets in the URL):

```
https://bitbucket.org/site/oauth2/authorize?client_id={consumer_key}&response_type=code
```

When you hit Enter, you will see a page requesting that you grant access to the workspace. Select **Grant access** and then you will get redirected to

```
http://localhost/?code=fpYPDYsryEpsRawrj4
```

The code will be different, the above is just an example. Copy the code from the response (in my example it's fpYPDYsryEpsRawrj4)

**3.** You can then obtain an access token by executing the following command on a terminal

```
curl -X POST -u "key:secret" https://bitbucket.org/site/oauth2/access_token -d grant_type=authorization_code -d code=fpYPDYsryEpsRawrj4
```

Replace **key** with the consumer's key  
Replace **secret** with the consumer's secret  
Replace the code value in there (fpYPDYsryEpsRawrj4) with your code from the previous step

The output will look like this:

```
{
"access_token" : 6yElg-w1wXrlbM826XY1Nu-w5WfObqP0EOYo2JFMzs615QxZaX9z8Gsy_21yT23Ujftblt8eKeBAcfhCrHY=,
"scopes": "repository",
"expires_in" : 7200,
"refresh_token" : 2Eoiw6UJ707AD9aIyUR,
"token_type" : bearer
}
```

**4.** You can use now the access token from the previous step, to clone any repo the workspace owns, as follows:

```
git clone https://x-token-auth:{access_token}@bitbucket.org/<workspace-id>/<my-repo>.git
```

<br />

Replace **access_token** with your access_token from the previous step, but leave the brackets in the URL. Also, make sure to replace the workspace-id and repo name.

**5.** Our access tokens expire in two hours. When this happens you'll get 401 responses.

You will have to use the refresh token from the output in step 3 to get a new access token.

```
curl -X POST -u "key:secret" https://bitbucket.org/site/oauth2/access_token -d grant_type=refresh_token -d refresh_token={2Eoiw6UJ707AD9aIyUR}
```

<br />

Replace **key** with the consumer's key  
Replace **secret** with the consumer's secret  
Replace the value of the **refresh_token** in there (2Eoiw6UJ707AD9aIyUR) with the one from the output in step 3.

The output of the above command will give you a new access token (with the same 2 hour expiry) and also a refresh token.

If you have any questions, please feel free to let me know.

Kind regards,  
Theodora

comments: author: Franz Holzinger
body: This is very clear and works fine.

And I even can use it with a call to composer which accesses the Bitbucket url to do this cloning.

See <https://getcomposer.org/doc/articles/authentication-for-private-packages.md> .

```
composer config [--global] bitbucket-oauth.bitbucket.org x-token-auth {access_token}
```

The only drawback is that I have to execute the refresh command every to 2 hours. And this will give me a new access token. And as a consequence I will have to execute the command from above again.   

It would be nice if I could increase the timeout to 7 days.


author: Theodora Boudale
body: Hi Franz,

Thank you for your reply, I'm glad that this works for you.

I'm afraid that it is not possible to change the expiry time for access tokens.

If this is an issue for you, the other alternative I can suggest is the app passwords, which don't have an expiry date:

<https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/>

Kind regards,  
Theodora


Tags: bitbucket-cloud

cloud

oauth