Access tokens for a project

Access tokens for a project are per-project passwords for scripting tasks and integrating tools (such as CI/CD tools) with Bitbucket Cloud. Access tokens for a project are designed for use with a single application with limited permissions, so they don't require two-step verification (2SV, also known as two-factor authentication or 2FA). Project-level access tokens are tied to a Bitbucket project, not a user's account, restricting the token's access to a single project and any repositories in that project. This provides a more secure solution than user-based authentication methods such as App passwords.

Project-level access token features

Access tokens for a project have the following features:

• They can be used to authenticate API calls.

• They have limited permissions (scopes) specified when the access token is created.

• They're intended to be single-purpose rather than reusable.

• They're encrypted on our database and can't be viewed by anyone.

• They can have an expiry date.

Project-level access token limitations

Access tokens for a project have the following limitations:

• They can't be viewed or edited after they are created. They are intended to be replaced with a new access token rather than recovered or modified.

• They can't be used to log in to your Bitbucket account at bitbucket.org.

• They will stop working when they are revoked.

• They can't be used to manage or interact with workspaces or other projects.