Git push using OAuth 2.0 token is not working: "remote: Invalid credentials"
Asked by marta_valls:

I'm trying to push some changes from a script locally.   
I already created a consumer for OAuth 2.0 following the [Use OAuth on Bitbucket Cloud guide](https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/). Already obtain the token from ***<https://bitbucket.org/site/oauth2/access_token>*** successfully.  
But when I try to push my changes (after adding and commit my changes):

```
git_url = f"https://oauth2:{oauth_token}@bitbucket.org/{my_repository}.git"
result = subprocess.run(["git", "push", "-u", git_url, source_branch], capture_output=True, text=True)
```

I got this error (token and repo anonymized for security purposes):

```
(Pdb) result
CompletedProcess(args=['git', 'push', '-u', 'https://oauth2:XXXXXXXXX@bitbucket.org/YYYYYYYYY.git', 'upgrade-version'], returncode=128, stdout='', stderr="remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/YYYYYYYYY.git/'\n")
```

To ensure I'm not using the wrong repository I directly copied and pasted from navigator by clicking in clone report and contains Workspace+repository name  

To obtain the OAuth Token:  

```
def obtain_oauth_token(client_id, client_secret):
    # Bitbucket OAuth token endpoint
    token_url = "https://bitbucket.org/site/oauth2/access_token"

    # OAuth token request parameters
    data = {
        "grant_type": "client_credentials"
    }

    # OAuth client credentials for authentication
    auth = (client_id, client_secret)

    try:
        # Send POST request to obtain OAuth token
        response = requests.post(token_url, data=data, auth=auth)

        # Check if request was successful
        if response.status_code == 200:
            # Parse JSON response and extract access token
            token_data = response.json()
            access_token = token_data.get("access_token")
            return access_token
        else:
            error_data = response.json()
            print(f"Failed to obtain OAuth token: <{response.status_code}> {error_data['error_description']}")
            return None
    except Exception as e:
        print("Error:", e)
        return None
```

<br />

Also, I tried to:  

```
command = ["git", "remote", "add", "oauth", f"https://oauth2:{oauth_token}@{repository_url}"]
result = subprocess.run(command, capture_output=True, text=True)
```

and later push using oauth:  

```
result = subprocess.run(["git", "push", "oauth", source_branch], capture_output=True, text=True)
```

But I'm having same issue than before:

```
(Pdb) result
CompletedProcess(args=['git', 'push', 'oauth', 'upgrade-version'], returncode=128, stdout='', stderr="remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/YYYYYYYYY.git/'\n")
```

Also I tried with ***https://x-token-auth:{oauth_token}@bitbucket.org/{repository}.git***:  

```
git_url = f"https://x-token-auth:{oauth_token}@bitbucket.org/{repository}.git"
result = subprocess.run(["git", "push", "oauth", source_branch], capture_output=True, text=True)
```

But it didn't work either  

Can someone help me on this?


Answers:
author: Theodora Boudale
body: Hi Marta and welcome to the community!

The correct remote URL when using an access token is

```
https://x-token-auth:{access_token}@bitbucket.org/{workspace-id}/{repo}.git
```

The literal string **x-token-auth** as a substitute for username is required.

Our access tokens expire in two hours, so in case you used the correct URL with an access token that was generated more than two hours ago, the operation will fail.

If you are still experiencing issues, I would suggest posting in the developer community which is specifically for development questions:

* <https://community.developer.atlassian.com/c/bitbucket-development/bitbucket-cloud/13>

Kind regards,  
Theodora

comments: author: marta_valls
body: Hello Theodora,   
Thanks for the reply!

Yes, my internal variable \`repository\` is the workspace + repo and I also tried including literal string \`x-token-auth\` but I'm having same error.   
I already posted on the developer community: <https://community.developer.atlassian.com/t/bitbucket-cloud-git-push-using-oauth-2-0-token-is-not-working-remote-invalid-credentials/78748>   

Kind regards,  
Marta


author: Theodora Boudale
body: Hi Marta,

I see that you don't have admin access to the workspace you are a member of. Did an admin provide you with the consumer key and secret?

I would suggest double-checking the following:

**1.** Confirm that the consumer key and secret you are using are correct

**2.** Confirm that the consumer has **Repositories - Read** and**Write** permissions

**3.** Confirm that the option **This is a private consumer** is checked

**4.** Ensure that there are ++no curly brackets in the URL++ around access_token, workspace-id, and repo

```
https://x-token-auth:{access_token}@bitbucket.org/{workspace-id}/{repo}.git
```

**5.** For testing purposes, generate an access token by running the following **curl** command on your terminal, where **client_id** and **secret** replace with the key and secret of your consumer

```
curl -X POST -u "client_id:secret" \
https://bitbucket.org/site/oauth2/access_token \
-d grant_type=client_credentials
```

Then, use the access token provided by the curl command and try to clone the repo from terminal with git, with the command

```
git clone https://x-token-auth:{access_token}@bitbucket.org/{workspace-id}/{repo}.git
```

Again, no curly brackets in the URL. Then, create a commit in that clone and try to push. This is to narrow down if the issue is specific to your script or not.

Kind regards,  
Theodora


Tags: bitbucket-cloud

cloud