Bitbucket Cloud · Git over SSH · Checked October 29, 2026

Bitbucket Cloud SSH moves to ssh.bitbucket.org

Atlassian is separating SSH from HTTPS on Bitbucket Cloud. bitbucket.org will serve only the web pages and the API, and Git over SSH moves to ssh.bitbucket.org. Remotes like git@bitbucket.org:<workspace>/<repo>.git stop working on December 10, 2026. Before that, from November 12, they fail during scheduled brownouts. HTTPS remotes are not affected.

The dates

From Atlassian's Community article Upcoming change to Bitbucket Cloud SSH access (updated October 21, 2026) and the Bitbucket Cloud changelog (CHANGE-3162, first announced May 12, 2026; brownout notice October 28). The change was due on November 12. After feedback from customers, Atlassian turned November 12 to December 10 into a grace period of brownouts. Each brownout day has four windows, starting at 00:00, 06:00, 12:00 and 18:00 UTC:

Days (2026)	Each brownout
November 12–13	15 minutes
November 16–20	30 minutes
November 23–24	1 hour
November 30 – December 2	2 hours
December 3–4 and 7–9	3 hours
December 10	Removed

Weekends and holidays are left out. During a brownout, Atlassian says it blocks SSH on bitbucket.org, returns "clear error messages" and shows messages in the product where it can. It has not published the wording.

What answers today

On October 29, 2026:

• ssh.bitbucket.org already answers on port 22, with the same host keys as bitbucket.org. Atlassian publishes them:

  SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM (ED25519)
  SHA256:FC73VB6C4OQLSCrjEayhMp9UMxS97caD/Yyi2bhW/J0 (ECDSA)
  SHA256:46OSHA1Rmj8E8ERTC6xkNcmGOw9oFxYr0WF6zWW8l1E (RSA)

• Without an accepted key, the two hosts answer alike:

  git ls-remote git@ssh.bitbucket.org:<workspace>/<repo>.git
  git@ssh.bitbucket.org: Permission denied (publickey).
  fatal: Could not read from remote repository.
  
  Please make sure you have the correct access rights
  and the repository exists.

  Atlassian's steps do not include adding your SSH key again: they are the remote URL, the host key, CI and the firewall. If your own key gets this answer after the change, see why ssh may stop offering it to ssh.bitbucket.org.
• altssh.bitbucket.org on port 443, the host for networks that block port 22, still answers with the same key. Atlassian's article points to it for those networks and does not say that it changes.

Change a repository

git remote -v
git remote set-url origin git@ssh.bitbucket.org:<workspace>/<repo>.git

A remote in the ssh:// form becomes ssh://git@ssh.bitbucket.org/<workspace>/<repo>.git. In IntelliJ IDEA, Git › Manage Remotes… edits the same URL. The first connection asks you to trust the host key: compare it with the fingerprints above.

The question, as OpenSSH 10.2 asked it on October 29, 2026. When your known_hosts already has bitbucket.org, it also says that this is the same key:

The authenticity of host 'ssh.bitbucket.org (…)' can't be established.
ED25519 key fingerprint is: SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:3: bitbucket.org
Are you sure you want to continue connecting (yes/no/[fingerprint])?

The fingerprint is the one above, so answer yes. Where there is no one to ask, as in CI, git stops instead:

Host key verification failed.
fatal: Could not read from remote repository.

That is the host key missing from known_hosts (below), not your SSH key or your access to the repository.

For every clone at once, a comment under Atlassian's article uses git's insteadOf:

git config --global url."git@ssh.bitbucket.org:".insteadOf "git@bitbucket.org:"
git config --global url."ssh://git@ssh.bitbucket.org/".insteadOf "ssh://git@bitbucket.org/"

With this, git rewrites the old address whenever it uses it, and git remote -v already shows git@ssh.bitbucket.org:… (git 2.53). It also covers new clones copied from the repository's Clone dialog: several comments under Atlassian's article, through October 2026, say the dialog still shows git@bitbucket.org.

CI, scripts and known_hosts

• The known_hosts line in Atlassian's article now adds a wrong host. It suggests curl -s https://bitbucket.org/site/ssh | sed 's/bitbucket.org/ssh.bitbucket.org/' >> ~/.ssh/known_hosts. On October 29, 2026, https://bitbucket.org/site/ssh already lists ssh.bitbucket.org itself (six lines, three for each name). The sed then also writes three lines for ssh.ssh.bitbucket.org. They do no harm, but they are wrong. Take the lines for ssh.bitbucket.org as they are, and check them:

  curl -s https://bitbucket.org/site/ssh | grep '^ssh\.bitbucket\.org ' >> ~/.ssh/known_hosts
  ssh-keygen -lf ~/.ssh/known_hosts

• Search your configuration for git@bitbucket.org: and ssh://git@bitbucket.org: CI/CD pipelines, deployment scripts, build servers, mirroring jobs and any tooling that runs git clone, fetch or push over SSH (Atlassian's list).
• Firewalls: allow ssh.bitbucket.org on port 22, and change any rule that names bitbucket.org for SSH.
• Bitbucket Pipelines: one comment under Atlassian's article says the Pipelines images trust bitbucket.org but not ssh.bitbucket.org, and that Settings › Pipelines › SSH Keys refuses to add it: "Failed to add known host. Bitbucket manages the SSH fingerprint settings for ssh.bitbucket.org." We have not checked this. If a step that uses SSH stops at the host key, the grep line above in the step adds it.

What does not change

• HTTPS remotes (https://bitbucket.org/<workspace>/<repo>.git) and the REST API at api.bitbucket.org. An HTTPS remote is signed in with an API token, not an SSH key (app passwords stopped working in July 2026).
• Also in November: the code search endpoints /2.0/workspaces/{workspace}/search/code (and the users and teams forms) answer 410 during brownouts from November 3 and are removed on November 15, 2026. Their replacement is POST /2.0/workspaces/{workspace}/codesearch (the same changelog, October 26).

Bitbucket pull requests in IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, finds the repository from the project's Git remotes. Version 1.0.53 (October 29, 2026) recognises remotes on ssh.bitbucket.org, in both forms. Earlier versions did not find the repository once the remote was changed. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro, with a 30-day trial. It also works with Bitbucket Data Center (beta).

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: "You may not have access to this repository" · "The requested URL returned error: 410" · Git Credential Manager's OAuth before 3.0.0 is blocked on November 30 · 日本語