What's the "best-practice" approach to authenticate a CI tool like Jenkins or Bamboo to BitBucket? I started with App Passwords because it's cheap and easy, but I hate that it's tied to my account because if I leave the company, the CI/CD integration with Bitbucket gets killed.

Is there anything that isn't scoped to a specific user?

1 Answer 1


In an enterprise environment (but even in a personal one, I assume tech savvy enough users to do that) it's generally a good idea to have dedicated accounts created specifically for automated tools execution.

I'd even recommend one account per tool because different tools may have different permission requirements and it's generally a good idea to limit the permission scope to the minimum required, for security reasons. In large enterprises this is often mandatory, prescribed by policies.

In some cases it might be necessary to have different tools executed under the same account, in which case such combo accounts would be required. Again, one per specific use case.

If you want a parallel - take a look at a Linux system, for example - different system accounts used for different purposes. Or service accounts, at Google for example.

  • Dan, thanks for the help! You're feedback makes a lot of sense. I only add that I'm a little more interested in which Bitbucket specific authentication mechanism folks recommend vs. shared or dedicated account paradigm. That said, dedicated accounts make a lot of sense for the reasons you mentioned.
    – Adam
    Apr 13, 2019 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.