Bitbucket's one-year API tokens schedule a repeat of the app-password outage for July 2027

Clients treat a 401 and a 410 differently. A 401 means unauthenticated, and most HTTP clients already have a code path for it ^[9]. According to the dev.to post, written on 22 July 2026, plenty of integrations catch the 401, re-authenticate with the same stored credential and log a generic auth warning ^[16][9]. A 410 means Gone, and the post calls it deliberately harsher ^[10]. Git clients have no retry path for it, so the failure surfaces at once ^[10]. One tool that both clones repositories and calls the API therefore fails hard on one side and quietly on the other ^[13]. If monitoring watches only the API half, the post says, it has seen a 401 blip for weeks with no alarm ^[13].

The git error also points at the wrong layer. It ends `fatal: unable to access '.../my-repo.git/': The requested URL returned error: 410`, after three `remote:` lines that cite CHANGE-3222 ^[11]. The post says git is not involved. The 410 is Bitbucket refusing the credential at the edge, and the remote URL, `.git/config`, git version and network are not implicated ^[11]. Until the final week the brownouts were intermittent, so a push could fail at 13:00 and succeed at 17:30, and that pattern got diagnosed as a flaky network ^[12]. "The intermittency was the schedule, not the symptom," the author wrote ^[14].

Finding who still sends an app password happens outside Bitbucket. Its audit log records only that an app password was added or removed, keeps entries for 30 days, and never records use ^[6]. The deprecation message is the signal that remains. CHANGE-3222 fires only on an app-password request ^[5]. If it still appears after a switch to a token, the token is not on the wire and something is still sending the old credential ^[5]. In my view, CI and client logs that keep the `remote:` output are the nearest thing to a usage report a team will get.

Atlassian's own timeline, as the post summarizes it, blocked new app passwords from 9 September 2025 and ran escalating brownouts from 9 June to 27 July 2026 before full removal on 28 July ^[1]. Of teams who said theirs still worked, the author wrote: "They are telling you they happened to run their pipeline inside a one-hour gap." ^[15]

I think a one-year cap with no extension is the right default for a credential that can push to a repository. A leaked token cannot outlive its year, and its latest expiry is known on the day it is created ^[8].