Encountering a “fatal: Invalid credentials” error when pushing to Bitbucket can be a frustrating roadblock for developers. This common message indicates that Git, your version control system, is unable to authenticate your identity with Bitbucket, preventing you from pushing your changes. Whether you’re a seasoned developer or just starting, this error often stems from issues with stored credentials, SSH keys, or even changes in Bitbucket’s authentication methods, such as the deprecation of passwords for Git operations in favor of app passwords for enhanced security. Understanding the root cause is the first step toward a swift resolution, ensuring your development workflow remains smooth and efficient.

Understanding the “fatal: Invalid credentials” Error

The “fatal: Invalid credentials” error in Git signifies a failure in the authentication process between your local machine and the remote Bitbucket repository. When you attempt to push code, Git sends your credentials to Bitbucket for verification. If these credentials—whether a username/password combination, an app password, or an SSH key—are incorrect, expired, or improperly configured, Bitbucket rejects the connection, resulting in this error message. This security measure prevents unauthorized access to your repositories and protects your code.

Most Git operations, including pushing to Bitbucket, rely on either HTTPS or SSH protocols for communication. HTTPS typically uses a username and password or a more secure app password, often managed by a credential helper on your system. SSH, on the other hand, uses a pair of cryptographic keys: a private key stored on your local machine and a corresponding public key registered with Bitbucket. A mismatch or issue with either of these authentication methods can lead to the “fatal: Invalid credentials” error, making it crucial to identify which protocol you’re using for your repository.

Common Causes

Several factors can lead to this authentication failure. One prevalent cause is outdated or incorrect credentials stored in your system’s Git credential helper. If you’ve recently changed your Bitbucket password or enabled two-factor authentication (2FA), your stored credentials will no longer be valid. Another common reason is an incorrectly configured SSH key, where the private key isn’t loaded into your SSH agent, or the public key isn’t properly added to your Bitbucket account. Network proxy settings or firewall rules occasionally interfere with Git’s ability to reach Bitbucket’s servers, though this is less frequent for credential-specific errors.

Solutions for HTTPS Authentication Issues

If you’re using HTTPS to connect to Bitbucket, resolving the “fatal: Invalid credentials” error often involves managing your stored credentials or generating new ones. Bitbucket strongly recommends using app passwords instead of your main account password for Git operations, especially if you have two-factor authentication enabled. This method provides a more secure way to authenticate your Git commands and is a common fix for many credential-related issues.

Updating Stored Credentials

Your operating system likely uses a credential helper to cache your Git login information. When your Bitbucket password changes, this cached data becomes stale. To resolve this, you need to update or clear the stored credentials:

• For macOS: Open Keychain Access (Applications > Utilities > Keychain Access), search for “bitbucket.org”, and delete the entry. The next time you push, Git will prompt you for new credentials.
• For Windows: Open Credential Manager (Control Panel > User Accounts > Credential Manager), go to “Windows Credentials”, find the generic credential for “git:https://bitbucket.org”, and remove or edit it.
• For Linux: The process might vary, but you can often clear the cache by running git credential-osxkeychain erase (if using osxkeychain) or checking your ~/.gitconfig for credential helper settings.

Using App Passwords (for 2FA)

If you have two-factor authentication enabled on your Bitbucket account, your regular password won’t work for Git operations. Instead, you’ll need to generate an app password. Here’s how:

1. Log in to your Bitbucket account.
2. Navigate to your personal settings (click your avatar, then ‘Personal settings’).
3. Under ‘Security’, select ‘App passwords’.
4. Click ‘Create new app password’.
5. Give it a descriptive label (e.g., “Git Access”).
6. Grant it the necessary permissions (at minimum: ‘Repositories’ > ‘Read’ and ‘Write’).
7. Click ‘Create’.
8. Bitbucket will display the app password ONCE. Copy it immediately.
9. When Git prompts you for a password during a push, use this app password instead of your Bitbucket account password.

This is the recommended approach for secure Git access with 2FA, and it effectively resolves the “fatal: Invalid credentials” error when your main password is no longer valid for command-line operations.

Clearing Credential Helper Cache

Sometimes, simply updating the credentials isn’t enough, or the credential helper might be misbehaving. You can globally clear Git’s credential cache using the following command:

git credential-cache exit

This command stops the credential cache daemon, forcing Git to prompt for credentials on the next operation. Following this, you can then enter your app password. For more persistent issues, ensure your Git configuration is correctly set up to use a credential helper if you desire one, or remove it to always be prompted.

Troubleshooting SSH Key Authentication

When using SSH for Git operations, the “fatal: Invalid credentials” error points to an issue with your SSH key setup. SSH provides a highly secure way to connect to remote repositories without repeatedly entering a password, relying on a cryptographic key pair for authentication. If this key pair isn’t correctly configured or accessible, Git cannot prove your identity to Bitbucket.

Verifying SSH Key Setup

First, ensure you have an SSH key pair on your local machine and that the public key is added to your Bitbucket account. You can typically find your private keys in the ~/.ssh/ directory (e.g., id_rsa, id_ed25519). Your public key will have a .pub extension (e.g., id_rsa.pub). To check if your public key is added to Bitbucket, log into your Bitbucket account, go to ‘Personal settings’ -> ‘SSH keys’, and verify your key is listed. If not, you’ll need to add it.

Adding Key to SSH Agent

Your SSH agent is responsible for holding your private keys and making them available to SSH clients like Git. If your key isn’t loaded, Git won’t be able to use it. You can manually add your key to the SSH agent with these steps:

eval "$(ssh-agent -s)" ssh-add ~/.ssh/id_rsa or the path to your private key

You might be prompted for your SSH key’s passphrase if you set one during creation. It’s a good practice to ensure your SSH agent starts automatically with your system, especially on Linux and macOS. For detailed instructions on generating and adding SSH keys to Bitbucket, refer to Bitbucket’s official documentation on SSH keys.

Checking Bitbucket Deployment Keys

If you’ Question & Answer :

git push -u origin master fatal: Invalid credentials Password for 'https://<a class="__cf_email__" data-cfemail="7e0b0d1b0c101f131b3e1c170a1c0b1d151b0a50110c19" href="/cdn-cgi/l/email-protection">[email protected]</a>': remote: Bitbucket Cloud recently stopped supporting account passwords for Git authentication. remote: See our community post for more details: https://atlassian.community/t5/x/x/ba-p/1948231 remote: App passwords are recommended for most use cases and can be created in your Personal settings: remote: https://bitbucket.org/account/settings/app-passwords/ fatal: Authentication failed for 'https://bitbucket.org/username/demo.git/' 

How can I solve this issue?

When prompted to log in, use your username, but instead of your usual account password, use the app password:

To get the app password

1. Go to the bitbucket.org website and log in
2. From your gear in the upper right, and click Personal Bitbucket settings
3. Click App passwords under Access management
4. Click Create app password
5. Give the app password sufficient rights (probably write on the repo at a minimum), and a label related to the application that will use the password
6. Don’t forget to save that password