API Token authentication method can't access workspaces

[headphonejack]

Hello, using the API token method I get:

Error: Workspaces not found. Verify the ID is correct and that you have access to this workspaces.

configs.json is configured as follows:

  "bitbucket": {
    "environments": {
      "ATLASSIAN_SITE_NAME": "<my site name that appears in url as [my-site-name].atlassian.net>",
      "ATLASSIAN_USER_EMAIL": "<email address of my bitbucket account>",
      "ATLASSIAN_API_TOKEN": "<API token generated with all bitbucket scopes>",
      "BITBUCKET_DEFAULT_WORKSPACE": "<my only bitbucket workspace ID> "
    }
  }
}

My user definitely has access to the workspace and the token definitely has all bitbucket scopes. Am I missing something?

The readme says App Passswords are recommended, but they are deprecated in Atlassian now:

[aashari]

I'm planning to resolve this issue this week

[szymonwappfire]

Can confirm the issue. Btw documentation could use of scoped PATs now. They are no longer so 'dangerous' ;)

[kevinbgit]

Has this issue been resolved?

[cxl-todd]

This issue appears to still persist.

[gdncomm-muhammad-darmawan]

I edit the transport.util.js to fix it
You just can copy-paste this in the respected file

async function fetchAtlassian(credentials, path, options = {}) {
    const methodLogger = logger_util_js_1.Logger.forContext('utils/transport.util.ts', 'fetchAtlassian');
    // Set up base URL and auth headers based on credential type
  // --> Both have same url now
    const baseUrl = 'https://api.bitbucket.org';
    let authHeader;
    if (credentials.useBitbucketAuth) {
        // Bitbucket API uses a different base URL and auth format
        if (!credentials.bitbucketUsername ||
            !credentials.bitbucketAppPassword) {
            throw (0, error_util_js_1.createAuthInvalidError)('Missing Bitbucket username or app password');
        }
        authHeader = `Basic ${Buffer.from(`${credentials.bitbucketUsername}:${credentials.bitbucketAppPassword}`).toString('base64')}`;
    }
    else {
        // Standard Atlassian API (Jira, Confluence)
       // --> Doesn't need to check the sitename
        if (!credentials.userEmail ||
            !credentials.apiToken) {
            throw (0, error_util_js_1.createAuthInvalidError)('Missing Atlassian credentials');
        }
        authHeader = `Basic ${Buffer.from(`${credentials.userEmail}:${credentials.apiToken}`).toString('base64')}`;
    }

[ibru]

I had this issue too. I"ve edited the transport.util.js based on @muhammad-darmawan changes and now it works properly.
Please can we merge this fix into main branch? @aashari

[aashari]

✅ RESOLVED - Fixed in PR #117!

@headphonejack This exact issue has been completely fixed! The problem was that the code was incorrectly trying to use Atlassian workspace URLs instead of the Bitbucket API endpoint for API token authentication.

🔧 What Was Wrong

The code was trying to use https://your-site-name.atlassian.net for API tokens, but Bitbucket API tokens must use https://api.bitbucket.org regardless of your Atlassian site name.

✅ Solution Implemented

• Fixed base URL: All API token requests now correctly use https://api.bitbucket.org
• Removed siteName dependency: ATLASSIAN_SITE_NAME is no longer required for API tokens
• Enhanced error handling: Better error messages for debugging authentication issues

🧪 Verified Working

I've tested this fix with real scoped API tokens created via the Atlassian API token page, and it works perfectly:

• ✅ Workspace access: Successfully retrieves workspace permissions
• ✅ Repository access: Successfully lists repositories
• ✅ Both CLI and MCP modes: Working in all transport modes

🚀 How to Update Your Config

Your config should now work with just these fields (no ATLASSIAN_SITE_NAME needed):

{
  "bitbucket": {
    "environments": {
      "ATLASSIAN_USER_EMAIL": "<your-email@company.com>",
      "ATLASSIAN_API_TOKEN": "<your-scoped-api-token>",
      "BITBUCKET_DEFAULT_WORKSPACE": "<your-workspace-slug>"
    }
  }
}

📚 Updated Documentation

The README has also been updated with:

• Deprecation warning about Bitbucket app passwords (June 2026 sunset)
• Comprehensive scoped API token instructions with step-by-step guide
• Updated configuration examples that prioritize API tokens

The fix is ready to merge! You'll be able to use scoped API tokens seamlessly once PR #117 is merged. 🎉

Thanks for reporting this issue - it helped identify and fix a critical authentication problem!

[aashari]

This issue has been resolved in PR #117 which includes a comprehensive fix for API token authentication. The solution:

✅ Fixed baseURL to use https://api.bitbucket.org for both app passwords and API tokens
✅ Removed siteName requirement for API token configuration
✅ Updated documentation with Bitbucket app password deprecation warnings
✅ Added comprehensive migration guide to scoped API tokens
✅ Tested end-to-end with real API tokens

The PR includes the core fix plus additional improvements:

• Proper test validation
• Comprehensive README updates
• Global configuration examples
• Both authentication methods supported

Resolution complete.