Lesstep
Bitbucket Cloud · API tokens · Checked October 23, 2026

Bitbucket: "Your credentials lack one or more required privilege scopes."

The API token is valid, but it was created without a scope this call needs. Bitbucket Cloud refuses the call with HTTP 403 and names the missing scope in the answer. Create a new API token that includes it, and replace the old one wherever it was entered.

The whole answer

A real one, for GET /2.0/user with a token made for pull requests (from a public bug report):

HTTP 403
{"type": "error", "error": {
  "message": "Your credentials lack one or more required privilege scopes.",
  "detail": {
    "required": ["read:user:bitbucket"],
    "granted": ["write:repository:bitbucket", "read:pullrequest:bitbucket", "write:pullrequest:bitbucket", "read:repository:bitbucket"]}}}

required is what to add; granted is what the token has. Many tools show only the first line of the message, or cut the answer short, so the list may not reach you: call the same address with curl to see it.

curl -u 'your-atlassian-email:your-api-token' https://api.bitbucket.org/2.0/user

Over git: "remote: Your credentials lack one or more required privilege scopes."

Git prints the same refusal with remote: in front, followed by a 403. From a question on Atlassian Community (February 2022), where pulling worked and pushing a tag did not:

remote: Your credentials lack one or more required privilege scopes.
fatal: unable to access 'https://<user>@bitbucket.org/<path>/<repo>.git/': The requested URL returned error: 403

Git shows only the first line of the answer, not the required and granted lists. With an API token, Git needs read:repository:bitbucket to clone, fetch and pull, and write:repository:bitbucket as well to push, tags included: when pulling works and pushing fails, the token lacks the write scope. A 403 does not make Git forget the saved token (only a 401 does, as on the 410 page), so after making a new token, remove the old one from Git's credential helper and enter the new one when Git asks.

Scopes that pull request tools need

From Atlassian's API token permissions:

The scopes do not include each other. Atlassian lists that pull request read does not imply repository read, pull request write does not imply repository write, and repository write does not imply repository read. A token with only write:pullrequest or only read:pullrequest therefore still needs read:repository next to it.

Replace the token

  1. Your profile at the top right, Account settings, the Security tab, Create and manage API tokens.
  2. Create API token with scopes: a name and an expiry date, Bitbucket as the app, then the scopes: the ones you had plus every scope from required.
  3. Copy the token. Atlassian shows it only once and it cannot be retrieved later.
  4. Put the new token where the old one was, and revoke the old one on the same page.

For Git over HTTPS (read:repository to pull, write:repository to push), see switching Git to an API token.

Bitbucket pull requests in IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, signs in to Bitbucket Cloud with an Atlassian API token: read:pullrequest, read:repository and read:user to read, plus write:pullrequest to approve and merge. When Bitbucket refuses a call, the plugin shows the scopes from required and which one to add. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: Bitbucket pull request plugins for IntelliJ IDEA, compared · 日本語