Fetching repository archive using API Tokens

[Mateusz Ledwoń]

Hello everyone, I'm currently in the process of migrating from App Passwords to API Tokens and have encountered an issue that I cannot resolve.

In our current implementation, we download repository archives using https://bitbucket.org/<workspace_slug>/<repo_slug>/get/<ref>.tar.gz with username:app_password as basic authentication. When I switched the basic auth to email:api_token, I get a 401 error (though other API endpoints work fine with this authentication method).

```
curl --request GET --url https://bitbucket.org/<workspace_slug>/<repo_slug>/get/<ref>.tar.gz -u "email:api_token" -f
curl: (56) The requested URL returned error: 401
```

Is there a way to make this endpoint work with API tokens, or are there alternative endpoints that can return repository archives and work with API tokens?

Note: I'm aware that it's possible to clone repositories using git clone with API tokens, but I would prefer to avoid changing our entire implementation and stick with fetching archives.

[Theodora Boudale]

Hi,

I've reached out to my team internally about this, I will let you know as soon as I have an update.

Kind regards,
Theodora

[Theodora Boudale]

Hi Mateusz,

I got an update from my team. At the moment, API tokens do not work for downloading a repository archive. The development team is working to make the necessary changes to support this.

We created this bug report yesterday for tracking purposes:

• https://jira.atlassian.com/browse/BCLOUD-23783

You can continue to use username and app password for archive downloads for now, and then transition to API tokens when the bug is fixed. In the bug report I shared, you will see a link Start watching this issue (on the right side of the page). You can select that link to get subscribed to email notifications on updates; we will post updates there when the issue is fixed. You can also select the link This affects my team to indicate you are affected by the issue.

Please feel free to reach out if you have any questions.

Kind regards,
Theodora

[Mateusz Ledwoń]

Hi @Theodora Boudale,

Thank you so much for following up on this issue and for creating the bug report. I really appreciate you and your team taking the time to investigate this.

I've subscribed to the bug report for updates and marked that it affects my team.

I wanted to ask if there's any estimated timeframe for when this fix might be available? We're looking to allow our users to migrate from App Passwords to API Tokens, but this archive download functionality is currently blocking that migration.

Thanks again for your help with this!

Best regards,
Mateusz

[Theodora Boudale]

Hi Mateusz,

I'm afraid that I don't have an ETA to share, but it will be resolved before we fully deprecate app passwords next year (June 9th 2026). The creation of new app passwords will be disabled on September 9th 2025, but existing app passwords will continue to work until June 8th 2026.

Kind regards,
Theodora