AlgoInsight

Q&A

How to use a Bitbucket private repository in your projects

By AlgoInsight Team2026-06-18devopsgitnetworkingnodejsjavascriptpython

Overview

A private Bitbucket repository requires authentication for every git operation (clone, push, pull). How you authenticate - and how you embed that authentication in tooling - differs by use case: interactive development (SSH keys), CI/CD pipelines (access tokens), and package dependencies (authenticated URLs or build environment variables).

graph TD
    A[Access private Bitbucket repo] --> B[SSH key: recommended for developers]
    A --> C[HTTPS + App Password: simple, token-based]
    A --> D[Repository Access Token: CI/CD pipelines]
    B --> E[git clone git@bitbucket.org:org/repo.git]
    C --> F["git clone https://user:token@bitbucket.org/org/repo.git"]
    style B fill:#1e1b4b,color:#fff

Option 1: SSH Key (recommended for day-to-day use)

SSH keys authenticate without a password prompt and are more secure than embedding credentials.

Set up once:

# 1. Generate a key (if you don't have one)
ssh-keygen -t ed25519 -C "your@email.com"

# 2. Copy the public key
cat ~/.ssh/id_ed25519.pub

# 3. Add it to Bitbucket:
# Account Settings → SSH keys → Add key → paste the public key

Clone and use:

git clone git@bitbucket.org:workspace/repository.git
cd repository
git pull       # no password prompt
git push       # no password prompt

Option 2: HTTPS with App Password

Bitbucket's App Passwords (workspace → Account → App Passwords) are scoped tokens that work in place of your account password:

# Clone
git clone https://username@bitbucket.org/workspace/repo.git
# Git prompts for password - enter your App Password (not your account password)

Or embed in the URL (for scripts - store the token securely):

git clone https://username:APP_PASSWORD@bitbucket.org/workspace/repo.git

Option 3: Repository Access Token (CI/CD)

For automated pipelines, generate a Repository Access Token (or workspace-level token) in Bitbucket's repository settings → Access Tokens. Use the token in pipeline environment variables:

# In a CI/CD script
git clone https://x-token-auth:${REPO_ACCESS_TOKEN}@bitbucket.org/workspace/repo.git

Tokens have scopes (read, write) and expiry dates - apply least privilege.

Bitbucket Pipelines (built-in CI/CD)

Pipelines running inside Bitbucket have implicit access to the repo being built. For external repos, store the token as a Repository Variable and reference it:

# bitbucket-pipelines.yml
pipelines:
  default:
    - step:
        script:
          - git clone https://x-token-auth:$MY_REPO_TOKEN@bitbucket.org/org/private-repo.git

Using a Private Repo as a Dependency

npm/Node.js

// package.json
"dependencies": {
  "my-private-lib": "bitbucket:workspace/repo#main"
}

Requires SSH key or the GIT_SSH_COMMAND / SSH agent in the environment.

pip/Python (requirements.txt)

git+https://username:APP_PASSWORD@bitbucket.org/workspace/repo.git@main#egg=mypackage

Or use environment variable injection to avoid hardcoding credentials.

Composer (PHP)

"repositories": [{ "type": "vcs", "url": "git@bitbucket.org:workspace/repo.git" }],
"require": { "vendor/package": "^1.0" }

Security Best Practices

Why This Matters in Interviews

DevOps/backend interviews use this to check real-world git and CI/CD experience. Key points: SSH keys are the right choice for interactive developer use; App Passwords/Repository Access Tokens are the right choice for scripts and CI; never embed credentials in committed code (use env vars or secrets); and package-dependency URLs require authentication injection in the build environment. Demonstrating the different access patterns for different contexts is the signal.

Common Pitfalls

References

More answers