Git Credential Manager (GCM) upgrade required for continued OAuth 2.0 Git authentication
- Announced
- Effective
- Sunset
- Tags
- rest-bitbucket-cloud
- Severity
- breaking, set by
reef/atlassian-rule-v2 - Source
- https://developer.atlassian.com/changelog/#CHANGE-3488
What's changing
On 2026-11-30 Git requests authenticated using OAuth2.0 via the Git Credential Manager (GCM) will be blocked for versions prior to 3.0.0. This is caused by the lack of support for rotating OAuth refresh tokens, which have recently begun being enforced for Bitbucket’s OAuth 2.0 implementation. See: https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052. Atlassian contributed changes to the open source project to include support for the rotating refresh token model, which was bundled in the v3.0.0 release (https://github.com/git-ecosystem/git-credential-manager/releases/tag/v3.0.1)
What you need to do
| If | Action/s Required? |
|---|---|
| You are NOT using Git Credential Manager | No action is required |
| You ARE using Git Credential Manager configured with personal access tokens | No action is required |
| You ARE using Git Credential Manager configured with OAuth2.0 | You must upgrade Git Credential Manager to a version 3.0.0 or higher by 2026-11-30 if you wish to continue to authenticate Git using this mechanism. Simply upgrading the version should ensure seamless authentication. Note: Impacted users will see a message after each git push operation prior to upgrade. |
More details
Upgrade instructions
Follow the GCM documentation for operating system specific installation instructions herehttps://github.com/git-ecosystem/git-credential-manager/blob/main/docs/install.md.
Note: For Git For Windows (https://git-scm.com/install/windows) users, GCM is bundled. Git For Windows releases are tied to the upstream Git release - currently there is no available release which bundles the pre-requisite version of GCM. Until a new version is cut, please install a suitable version of GCM directly. These instructions will be updated with the required Git for Windows version once a suitable release is available.
Further details
If you want to learn more about the changes made in Git Credential Manager see:
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.