Skip to main content

​
Get credentials

1

​
Create an OAuth consumer

Go to your Bitbucket workspace settings: Workspace Settings > Apps and features > OAuth consumers > Add consumer.Set the Callback URL to:
https://your-app.com/api/kavach/auth/oauth/callback/bitbucket
Under Permissions, enable at minimum Account: Read.
2

​
Copy your credentials

After saving, expand the consumer to see the Key (client ID) and Secret (client secret).

​
Configuration

lib/kavach.ts
import { createKavach } from 'kavachos';
import { oauth, bitbucketProvider } from 'kavachos/auth';

const kavach = await createKavach({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  secret: process.env.KAVACH_SECRET!,
  baseUrl: 'https://your-app.com',
  plugins: [
    oauth({
      providers: [
        bitbucketProvider(
          process.env.BITBUCKET_CLIENT_ID!,
          process.env.BITBUCKET_CLIENT_SECRET!,
        ),
      ],
    }),
  ],
});

BITBUCKET_CLIENT_ID=...
BITBUCKET_CLIENT_SECRET=...

​
Scopes

Default scope: account
ScopeWhat it unlocks
accountRead account info, email, profile
emailRead primary email address
repositoryRead repository list
teamRead workspace/team memberships
Bitbucket does not expose the user’s email by default through the profile endpoint if it is set to private. The email scope fetches it from a separate endpoint. KavachOS requests both automatically.

​
Endpoints

MethodPathDescription
GET/auth/oauth/authorize/bitbucketRedirect to Bitbucket
GET/auth/oauth/callback/bitbucketHandle callback
Last modified on April 17, 2026