If you’re pushing to Bitbucket and suddenly see this:
remote: CHANGE-3222 - Functionality has been deprecated
remote: App passwords are deprecated and must be replaced with API tokens.
remote: https://developer.atlassian.com/cloud/bitbucket/changelog#CHANGE-3222
fatal: unable to access 'https://bitbucket.org/yourteam/yourrepo.git/': The requested URL returned error: 410
…Atlassian has deprecated app passwords in favor of API tokens. That part’s simple. What wasn’t simple was figuring out why, even after generating a fresh token, authentication kept failing inconsistently across terminal, Android Studio, and two different operating systems — until it turned out the actual cause had nothing to do with any of that.
The actual root cause: an invisible newline in the copied token
When you click “copy” on a freshly generated Atlassian API token, on Windows the clipboard can pick up a trailing newline character along with the token itself. It’s completely invisible — paste it into any input field and it looks totally normal, same length, same characters visible. But git (and Android Studio’s credential dialogs) see it as part of the password, and a token + \n is not the same string as the token alone. Every single authentication attempt using that copy was doomed from the start, no matter how it was entered — terminal, GCM, Android Studio’s own dialog, didn’t matter.
On Mac, the same copy action didn’t pick up the trailing newline, which is exactly why the identical steps “just worked” there and not on Windows. It wasn’t an OS-specific credential-handling difference at all — it was a clipboard difference.
The fix, once identified, was almost embarrassingly simple: paste the token into a plain text editor first, manually strip any trailing newline/whitespace, then copy that into Android Studio’s credential field. Once done, it worked immediately, with no other changes needed.
If you’re hitting this on Windows, check this first — before touching GCM settings, Android Studio’s KeePass store, or anything else:
- Paste your copied token into Notepad or a similar plain editor.
- Turn on “Show all characters” / non-printing characters if your editor supports it, or just press End on that line and see if the cursor moves further than expected, or press Down arrow and check if it lands on a new, empty line.
- Strip any trailing newline/whitespace before using it anywhere.
Everything else I tried along the way (mostly red herrings, but documented in case they’re genuinely useful to someone)
Because the actual cause wasn’t obvious, I went down several other paths first. None of these were the real fix, but they’re real, working techniques worth knowing about Bitbucket + Git Credential Manager + Android Studio, so I’m keeping them here rather than deleting the work:
Basic terminal re-auth (Windows / GCM, or Mac / osxkeychain):
git config --global credential.bitbucketAuthModes basic
git credential-manager erase https://bitbucket.org
git push
# Mac equivalent
printf "protocol=https\nhost=bitbucket.org\n" | git credential-osxkeychain erase
git fetch
Username = your Bitbucket workspace username (not email), password = the API token.
GCM re-validating a cached token on every push (a real, separate quirk — GCM checks stored credentials against Bitbucket’s API before each use, and can wrongly discard a valid one on a flaky connection):
git config --global credential.bitbucketValidateStoredCredentials false
Android Studio’s own separate credential store: it doesn’t only rely on plain git — it has its own Bitbucket account integration with its own store (KeePass on Windows, native keychain option available on Mac via Settings → Appearance & Behavior → System Settings → Passwords). On Windows there’s no native-keychain option, only KeePass or session-only.
Settings → Version Control → Git → "Use credential helper": enabling this tells Android Studio to defer to the system git credential helper instead of its own dialog/store.
Embedding the token directly in the remote URL as a last-resort bypass:
git remote set-url origin https://x-bitbucket-api-token-auth:YOUR_API_TOKEN@bitbucket.org/pccs/yourrepo.git
This works and survives restarts, but stores the token in plain text in .git/config — visible to anyone with read access to that folder, and visible in Android Studio’s Manage Remotes dialog. Fine for a personal machine, not something to use on a shared one.
In hindsight, several of these “worked” not because the underlying setting mattered, but because re-typing or re-pasting the token through a different path sometimes accidentally avoided the trailing newline — which is exactly the kind of thing that makes an intermittent bug so maddening to chase.
TL;DR
If Bitbucket API token auth is failing in ways that don’t quite make sense — works in one place but not another, works once then not again — check for an invisible trailing newline in your copied token before anything else, especially on Windows. It’ll save you the entire detour above.