Lesstep
Bitbucket Cloud · REST API · Checked October 24, 2026

Bitbucket: "Token is invalid, expired, or not supported for this endpoint."

Bitbucket Cloud answers this with HTTP 401 when it does not take the token in the request. Each kind of Bitbucket token has to be sent its own way, and the message does not say which kind it expected. In public reports, the usual causes are an Atlassian API token sent as a Bearer token or made without Bitbucket scopes, an access token that expired or is used outside its repository, project or workspace, and an OAuth access token older than one hour.

The whole answer

HTTP/1.1 401 Unauthorized
Content-Type: application/json
WWW-Authenticate: OAuth realm="Bitbucket.org HTTP"

{"type": "error", "error": {"message": "Token is invalid, expired, or not supported for this endpoint."}}

Which token, and how Bitbucket takes it

  1. An Atlassian API token (id.atlassian.com → Security → API tokens) goes in HTTP Basic, with the e-mail of its Atlassian account as the user name: curl -u you@example.com:<API token> https://api.bitbucket.org/2.0/user. Sent as Authorization: Bearer <API token>, it gets this message. For git, the user name is your Bitbucket username or x-bitbucket-api-token-auth instead (the git side). An API token also expires: you choose 1 to 365 days when you create it, one year by default (Atlassian's Manage API tokens). New app passwords could no longer be created from September 9, 2025 (app passwords), so API tokens made from then on with the default expiry reach their year from September 2026; make a new one when yours has expired.
  2. An API token made without Bitbucket scopes. A command-line tool reported in June 2026, after checking against real Bitbucket, that an Atlassian API token without Bitbucket scopes gets this message even in HTTP Basic with the right e-mail. Make one with Create API token with scopes and choose Bitbucket and its scopes (which scopes).
  3. A repository, project or workspace access token goes as Authorization: Bearer <access token>, and with git as the password for the user name x-token-auth (Atlassian's Using access tokens). Atlassian lists its limits: it can have an expiry date, stops working when it is revoked, and cannot be used with other workspaces, projects or repositories than its own. Check the token's expiry where it was created, or make a new one.
  4. An OAuth 2.0 access token (an OAuth consumer, used by CI servers and editor extensions): Bitbucket's REST API introduction says its access tokens expire in one hour and then get 401; the refresh token gives a new one. In a September 2026 report about Woodpecker CI, every operation with one user's token failed with this message until that user signed in again.

Bitbucket pull requests in IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, signs in to the REST API with your Atlassian e-mail and an API token in HTTP Basic; when you leave the e-mail empty, it sends the token as a repository, project or workspace access token. From version 1.0.25, when Bitbucket refuses such a token, it says that an Atlassian API token needs the e-mail of its account, and that an access token may have expired or works only on its own repository, project or workspace. It lists the pull requests that wait for your review in an IDE tool window. Public repositories are read without a token. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: Rate limit for this resource has been exceeded · Your credentials lack one or more required privilege scopes · Bitbucket pull request plugins for IntelliJ IDEA, compared · 日本語