Work with Bitbucket Cloud repositories, pull requests, issues, branches, and Pipelines through the gateway. Connect with your own Bitbucket OAuth consumer.
OneCLI connects AI agents to Bitbucket Cloud through OAuth. Agents can read repositories, clone and push over HTTPS, open and comment on pull requests, work with issues and branches, and read Pipelines runs. The gateway signs every request, API calls and git alike, so your agent never sees the token.Bitbucket uses your own Bitbucket OAuth consumer. It is separate from the Atlassian app behind Jira and Confluence: Bitbucket Cloud registers consumers inside a Bitbucket workspace, not in the Atlassian developer console. Setup takes about five minutes, once.
In Bitbucket, open your workspace, then Settings (the gear) > Workspace settings > Apps and features > OAuth consumers, and click Create OAuth client (older workspaces show Add consumer). Name it OneCLI.
2
Set the grant type and callback URL
On the Authorization tab, tick Authorization code, then Refresh token. Leave Client credentials off.In OneCLI, open Connections > Bitbucket > Custom credentials and copy the Redirect URI. Paste it into Callback URLs in Bitbucket.
3
Choose the scopes
On the Scopes tab, tick:
Area
Scope
Account
Read
Workspace membership
Read
Projects
Read
Repositories
Read, Write
Pull requests
Read, Write
Issues
Read, Write
Pipelines
Read
Leave every Admin and Delete scope, and Webhooks, off. Bitbucket fixes scopes on the consumer, so every account connected through it gets exactly these.
4
Add your credentials and connect
Save the consumer, then copy its Key and Secret into OneCLI’s Custom credentials and click Save credentials. Click Connect Bitbucket and Accept on the Atlassian consent screen.
OneCLI's connect window opens and takes you to Bitbucket.
The consent screen lists exactly the scopes you chose, and the OneCLI callback it returns to.
List and read repositories, files, commits, and branches. Clone and push over HTTPS
Pull requests
List and read pull requests. Open, edit, comment on, merge, and decline them
Issues
List and read issues. Create and comment on issues
Branches
Create and delete branches
Pipelines
Read Pipelines runs and their logs
Agents clone with a plain URL, for example git clone https://bitbucket.org/acme/web.git. Never put a token in the URL: the gateway adds it.
Creating or deleting repositories needs the Repositories: Admin scope, which this setup leaves off on purpose. An agent that tries reports the missing scope instead of retrying.
Grant the connection to each agent that needs it, and choose per tool what runs freely, what needs approval, and what’s blocked. By default, reads run freely and every write (a push, a new pull request, a comment) asks for approval. Reading Pipelines variables, deploy keys, or webhooks always asks first, because they can hold secrets. Organization rules add guardrails on top. A blocked request never reaches Bitbucket.Bitbucket access tokens last two hours and refresh automatically. A connection left unused for three months needs reconnecting, because Bitbucket expires its refresh token.To disconnect, remove the connection in Connections > Bitbucket, then revoke OneCLI in Bitbucket under Personal settings > App authorizations.
