Bitbucket does not support implicit authentication

[twocs]

Describe the bug
The Decap CMS guide describes connectivity with Bitbucket using implicit grant.

https://decapcms.org/docs/bitbucket-backend/

On February 27, 2026, Bitbucket stopped allowing implicit grant because it is insecure.

https://community.developer.atlassian.com/t/deprecation-notice-oauth-1-0-and-implicit-grant-flows-for-bitbucket-cloud/97520

So I think we should either be guided towards a setup for Bitbucket using a supported authentication method, or Bitbucket should be removed from the application.

[sltnsrh]

Hi, any updates on this? Could you please suggest a temporary workaround?

[twocs]

Bitbucket supports Oauth and Decap also supports it. Unfortunately none of the third party oauth clients mention Bitbucket. I assume you could use Netlify's git-gateway https://decapcms.org/docs/git-gateway-backend/ but I worked with ChatGPT to setup my own oauth client.

At a high level, the workaround is:

• Decap opens your auth endpoint instead of Bitbucket directly
• Your backend redirects to Bitbucket with response_type=code
• Bitbucket redirects back to your backend callback
• Your backend exchanges the code for tokens server-side
• Your callback page posts the auth result back to the Decap popup flow
• Your backend optionally supports token refresh via a refresh endpoint

---

We can use the netlify-cms-backend-bitbucket . So basically we're going to need to update the documentation around Client-Side Oauth Grant (Bitbucket).

With Bitbucket’s Oauth Grant, a backend can proxy authentication with Bitbucket to the client. To do this:

Follow the Atlassian docs to create an OAuth consumer. Make sure you allow Account/Read and Repository/Write permissions. To use the Editorial Workflow, allow PullRequests/Write permissions. For the Callback URL, enter the backend "callback" address, for example, https://www.mysite.com/cms/oauth/callback.

Bitbucket gives you an ID and a SECRET. Copy them and enter it in your backend .env file, along with the following settings in your decap.yml:

backend:
name: bitbucket
repo: owner-name/repo-name
branch: default
base_url: https://www.mysite.com/
auth_endpoint: https://www.mysite.com/cms/oauth/auth

For auth_type in the yaml, you can omit it or set it to anything except "implicit" and it will use your oauth backend.

[martinjagodic]

@twocs this is very useful. Would you share your oauth client? If would be great to list it in the 3rd party clients list, and then mention it in the updated docs for Bitbucket.

Then, can you open a PR for the docs with your suggestion?

[twocs]

I found that the Bitbucket limits of 1000 operations per hour really doesn't work well with a Decap instance with only 30 articles. Other providers like Github have much more generous limits. I'm still considering how to do that effectively.

[sltnsrh]

I found that the Bitbucket limits of 1000 operations per hour really doesn't work well with a Decap instance with only 30 articles. Other providers like Github have much more generous limits. I'm still considering how to do that effectively.

It is most likely that mixed requests are occurring – some via the OAuth client, and others as direct CORS requests from the browser. Bitbucket has a limit of 60 such unauthorised requests per hour. Please check this in your browser’s network tools. If this is the case, you will need to redirect such requests via your client so that they are either not made or a token is added to them to make them authorized. For me 1000 request limit is more, than enough.