Personal Access Token documentation out of date?

[tallmorgan]

I am trying to follow the documentation on Personal Access Tokens. It tells me to go to Manage account > Account settings > Personal access tokens. However, when I visit Account settings, I see headers for: Account settings, Bitbucket profile settings, Preferences.

I have tried using App passwords, and I have tried creating API tokens through my Atlassian account. In both situations, I see the following error message despite having had just created each token:

> Access token expired. Use your refresh token to obtain a new access token.

I have tried using GrahamCampbell/Laravel-Bitbucket as well as Guzzle with Authorization header set to Bearer <ACCESS-TOKEN>. How can I make REST API requests with a Bitbucket personal access token?

[Dave Chevell · Accepted solution]

Hey Morgan,

It sounds like you're using Bitbucket Cloud.  The documentation you're looking at is for Bitbucket Server, our self-hosted/on-premise code hosting solution. Bitbucket Server has a different focus, so some of its features work differently.

To make API requests to Bitbucket Cloud, you can either use your normal account password (if you're not using 2 factor authentication), or else use an App password. 

The message you're receiving sounds like it's related to using OAuth, not using an app password. I would suggest manually querying the API using an app password to confirm that the app password is working, like so:

curl -u <your-username>:<your-app-password> https://api.bitbucket.org/2.0/repositories

This should return a paginated list of public repositories, which will confirm the app password is working.

Assuming this works I'd suggest going to the vendor of whatever tool you're using that produces the access token error, as it sounds like an OAuth issue unrelated to generating app passwords that may be related to the third party tool itself.

Cheers,

Dave

[tallmorgan]

Thanks! App passwords work great for my use case.