Bitbucket Data Center · git over HTTPS · REST API · October 30, 2026

Bitbucket Data Center: "CAPTCHA required. Your Bitbucket account has been locked."

Bitbucket Data Center (formerly Bitbucket Server) counted 5 failed sign-ins in a row for your user, the default, and now wants a CAPTCHA solved in a browser. Until then it refuses git over HTTPS and REST calls that sign in with your user name, even with the right password or token. Solving it once is not the whole fix: something sent the wrong credentials 5 times, and if it is still running, it locks the account again.

The answer

git prints Bitbucket's text after fatal: remote error::

fatal: remote error: CAPTCHA required
Your Bitbucket account has been locked. To unlock it and log in again you must
solve a CAPTCHA. This is typically caused by too many attempts to login with an
incorrect password. The account lock prevents your SCM client from accessing
Bitbucket and its mirrors until it is solved, even if you enter your password
correctly.

If you are currently logged in to Bitbucket via a browser you may need to
logout and then log back in in order to solve the CAPTCHA.

The REST API gives the same text in Bitbucket's error format:

HTTP/1.1 401
WWW-Authenticate: Basic realm="Atlassian Bitbucket"

{"errors": [{"context": null,
             "message": "CAPTCHA required. Your Bitbucket account has been locked. ...",
             "exceptionName": "com.atlassian.bitbucket.auth.CaptchaRequiredAuthenticationException"}]}

The 401 above is from a public report of a Jenkins job that approved a pull request with curl --user (2020). A command-line tool reported the same exception answering an approve with 403 (2025), and showed it as "XSRF check failed" until a fix.
Before the lock, a wrong password gets com.atlassian.bitbucket.auth.IncorrectPasswordAuthenticationException, according to Atlassian's knowledge base.
Not reproduced here: we have no Data Center server. The texts are the ones Atlassian's knowledge base and the reports quote.

Unlocking it

Yourself: open Bitbucket in a browser and sign in; the sign-in page asks for the CAPTCHA. If you are already signed in, sign out first: the message says you may need to.
If the sign-in page shows no CAPTCHA, as in a public report of a company that signs in through Okta (2022), ask an admin to clear it.
An admin clears it for one user with the REST API, as Atlassian's knowledge base shows for Bitbucket 7.x and 8.x:
```
curl --user <admin> -X DELETE "<base_url>/rest/api/1.0/admin/users/captcha?name=<user_name>"
```
The same page finds every locked user in the database (the failedAuthenticationAttemptCount attribute at 5 or more) and resets all of them, with Bitbucket stopped and backed up first.
An admin can turn the CAPTCHA off with feature.auth.captcha=false in bitbucket.properties and a restart (Atlassian: "How to configure CAPTCHA in Bitbucket Data Center", updated June 5, 2026). The default is true.

What sends the wrong credentials, in public reports

A saved old password after a password change. A desktop git client kept fetching with the password stored in the Windows Credential Manager (2022). Each fetch is one more failure.
A client that tries again on its own. In a git client's report, the lock came after 5 to 7 attempts in a row with a user name and password (2023). Tools that refresh on a timer do the same with an expired token.
A token with the wrong user name. In HTTP Basic, the user name must be the token's owner: a code search tool failed against Bitbucket Server until the user name of the person who made the token was added (2019).
A build job with stored credentials. A Jenkins pipeline called the REST API with curl --user on every build and was locked (2020).
git with an HTTP access token. A hosted build service got "CAPTCHA required" from git with an HTTP access token of the right permission (2022, no answer in the thread). git sends the token as the password in HTTP Basic, which the lock covers.
A token sent as a password while the database was short of connections. Atlassian's bug BSERV-20269 (reported on 8.19.0, fixed in 9.4.19, 10.2.2 and 10.3.0, closed in April 2026): when Bitbucket could not get a database connection, requests with a personal access token as the HTTP Basic password went to the external directory, which refused the token as a password. The account was locked in Bitbucket, or in Active Directory if its limit was lower.

Tokens and the lock

Atlassian's knowledge base: "Personal access tokens used in bearer auth will NOT trigger a captcha even with repeated auth failures." So for scripts and tools that call the REST API, send the token as Authorization: Bearer <token>, without a user name. git signs in with a user name and the token as the password unless told otherwise; Atlassian's page HTTP access tokens (Data Center 10.5) shows git sending it as Bearer instead:

git clone -c http.extraHeader='Authorization: Bearer <token>' <clone URL>

The same page recommends Basic for Git LFS, because of a known issue.

What to check

Unlock the account (above), then change nothing for a few minutes and see if it locks again. If it does, something is still sending the old password or token.
Look at every place that has your Bitbucket password or token: the operating system's credential store (Windows Credential Manager, the macOS keychain), the git credential helper, IDEs, desktop git clients, build servers and scheduled jobs.
For a token in HTTP Basic, check that the user name is the token's owner, and that the token has not expired: personal tokens are under Manage account → HTTP access tokens.
Where a tool lets you, leave the user name empty so the token goes as Bearer.

Bitbucket pull requests in IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the pull requests that wait for your review in an IDE tool window, from Bitbucket Cloud and, in beta, from Bitbucket Data Center 8.9 or later with a personal HTTP access token, sent only to that server. Without a user name in its settings, the token goes as Bearer. From version 1.0.56, when Data Center refuses a sign-in made with a user name, the plugin does not send it again until you change the token or user name or press Refresh, so its 5-minute refresh cannot lock the account; a locked account is named as such, with the server to open in the browser. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: Data Center "You are not permitted to access this resource" · Data Center "PKIX path building failed" · Bitbucket pull request plugins for IntelliJ IDEA, compared · 日本語