so whats the difference between App passwords and the api tokens that replaced them?

[Andrew Norman]

just wondering what the difference is between the 2 solutions and why the old solution (which itself was the replacement for an earlier solution) was being discontinued. 

the atlassian alert addressed the "when" but not the "where", "why", "how" etc

[Ben]

Hi @Andrew Norman 

API tokens provide more granular control over the access that is granted (scoped on a per-product basis with a larger breakdown of areas to grant access in that product). They align with our other products, which use API tokens rather than App Passwords for authentication. They can also be expired, whereas our App Password implementation could not (which allows for greater control over rotation requirements).

Please let me know if you require further information.

Cheers!

- Ben (Bitbucket Cloud Support)