Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Bitbucket access tokens reference

2 minute read

Bitbucket Cloud access tokens for CloudBees Unify integrations follow a three-tier containment hierarchy with differing scope support and plan requirements. Use this reference when configuring a Bitbucket integration or selecting the appropriate token type for your use case.

Token types

Bitbucket Cloud provides three token types, arranged from broadest to narrowest scope:

  • Workspace access token (WAT): Grants access to all projects and repositories in a workspace.

  • Project access token (PAT): Grants access to all repositories in a single project.

  • Repository access token (RAT): Grants access to a single repository.

Project and Workspace access tokens are a Bitbucket Cloud Premium feature. Bitbucket Standard plan customers can generate Repository access tokens only.
Project access token support has not been fully validated. Where possible, use a repository or workspace access token for production workflows.

Token type by use case

Use this table to select the appropriate token type for your CloudBees Unify integration.

Table 1. Token type by use case
Use case Recommended token type Notes

Single repository integration

Repository access token

One token per repository.

Multiple repositories in one project

Project access token

Supports repository:write scope. Suitable for workflows that commit workflow YAML back to repositories.

Multiple repositories with full workflow support

Workspace access token

Supports all CloudBees Unify operations including committing workflow YAML files back to repositories.

Triggering Bitbucket Pipelines

Any token type

Requires pipeline:write scope, available on all three token types.

Required scopes

The following table lists the Bitbucket scopes required for each CloudBees Unify operation, and which token types support them.

Table 2. Required Bitbucket scopes per CloudBees Unify operation
CloudBees Unify operation Required Bitbucket scope Repository token Project token Workspace token

Git checkout (clone)

repository (read)

Yes

Yes

Yes

SCM integration, commit workflow YAML

repository:write

Yes

Yes

Yes

Create webhooks

webhook

Yes

Yes

Yes

Run a Bitbucket pipeline

pipeline:write

Yes

Yes

Yes
Project access tokens support repository:write as of February 2023. All three token types can be used for workflows that commit YAML back to repositories.

Workspace field

When you configure a Bitbucket integration using a Project or Workspace access token, you must provide the Workspace slug in the integration form. The workspace slug is the value that appears in the Bitbucket URL: https://bitbucket.org/<workspace-slug>.

For existing integrations that have already onboarded at least one repository, the workspace is auto-populated by the hourly repository sync process. No manual action is required for those integrations.

Token expiration and rotation

Bitbucket access tokens have a configurable expiration date. Set an expiration date that aligns with your organization’s security policies. To rotate a token, create a new token in Bitbucket with the same scopes and update the corresponding CloudBees Unify secret.

Related pages

SCM permissions reference
ServiceNow actions reference