A successful Atlassian extension login does not automatically authenticate the separate Git process used by VS Code. For an HTTPS remote, Git needs your Bitbucket username and a scoped API token in place of the account password.
Last updated: October 15, 2026.
git remote -v
git remote set-url origin https://[email protected]/WORKSPACE/REPOSITORY.git
git fetch
# When Git asks for a password, paste the Bitbucket API token.Use the Bitbucket username shown in Bitbucket account settings, not the email address or token name. Usernames are case-sensitive for this authentication method.
Create a token for one purpose
Atlassian’s API token instructions require read:repository:bitbucket for cloning and both read and write:repository:bitbucket for pushing. Grant only the scopes the workstation actually needs and set an appropriate expiration.
Do not place the token permanently in the remote URL: it can leak through command history, configuration files, screenshots, and diagnostics. Let the operating system’s Git credential helper store it, or enter it interactively.
If cloning works but pushing fails, the token may have read scope without write scope. A 401 usually points to the username, token, or cached credential; a 403 more often means the authenticated account lacks repository access or the required token scope.
Separate Git authentication from editor integration
The Atlassian extension can authenticate Jira or Bitbucket features while command-line Git still uses its own remote and credential helper. Run git fetch in the repository terminal to test Git directly. If it fails, inspect git remote -v, remove obsolete saved credentials for bitbucket.org, and retry.
Atlassian describes API tokens as the long-term replacement for app passwords. Rotate a token immediately if it appears in a URL or log, and use separate tokens for local development and automation so one can be revoked without breaking everything.
SSH keys remain a separate valid choice for interactive Git access, but changing an HTTPS remote to SSH is a migration, not a fix for an API-token prompt. Pick one authentication method for the remote and document it for the team.
Continue with modern authentication architecture, safe API retry behavior, and secure browser cookies.
