> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bitbucket Cloud Integration

> Connect Bitbucket Cloud repositories to CodeThreat

Connect Bitbucket Cloud to scan your repositories for security vulnerabilities.

## Connection Methods

<Tabs>
  <Tab title="OAuth (Recommended)">
    **Best for**: Most users

    * One-click authorization
    * Workspace-level access
    * Automatic token management

    **Requirements**: Bitbucket Cloud account
  </Tab>

  <Tab title="App Password">
    **Best for**: Automation, restricted OAuth environments

    * Alternative to main password
    * Fine-grained permissions
    * Revocable independently

    **Requirements**: Bitbucket Cloud account
  </Tab>
</Tabs>

***

## OAuth Setup

<Steps>
  <Step title="Navigate to Integrations">
    **Settings** → **Integrations** → **Bitbucket** → **Connect with OAuth**
  </Step>

  <Step title="Authorize CodeThreat">
    You'll be redirected to Bitbucket. Click **Grant access** to authorize
  </Step>

  <Step title="Select Workspace">
    Choose which Bitbucket workspace to connect
  </Step>

  <Step title="Import Repositories">
    Select repositories to scan and click **Import**
  </Step>
</Steps>

### OAuth Permissions

CodeThreat requests:

* `repository:read`: Read repository content
* `pullrequest:read`: Access pull requests
* `webhook`: Manage webhooks

***

## App Password Setup

<Steps>
  <Step title="Open Bitbucket Settings">
    Click your profile → **Personal settings** → **App passwords**
  </Step>

  <Step title="Create App Password">
    Click **Create app password**

    **Label**: `CodeThreat Security Scanner`
    **Permissions**: Select:

    * ✅ **Repositories**: Read
    * ✅ **Pull requests**: Read
    * ✅ **Webhooks**: Read and write
  </Step>

  <Step title="Create and Copy">
    Click **Create** and copy the password immediately
  </Step>

  <Step title="Add to CodeThreat">
    **Settings** → **Integrations** → **Bitbucket** → Select **App Password**

    Enter your Bitbucket username and paste app password
  </Step>

  <Step title="Import Repositories">
    Select repositories to scan
  </Step>
</Steps>

***

## Webhook Configuration

CodeThreat creates webhooks automatically for automated scanning.

### Webhook Events

* **Repository push**: Trigger scans on commits
* **Pull request created**: Scan new PRs
* **Pull request updated**: Rescan on changes

### Verify Webhooks

1. In Bitbucket: Repository → **Settings** → **Webhooks**
2. Find webhook pointing to: `https://app.codethreat.com/webhooks/bitbucket`
3. Click webhook → **View requests** to see delivery history

***

## Pull Request Integration

Get security feedback directly in Bitbucket pull requests.

### Enable PR Scanning

In CodeThreat repository settings:

* Auto-scan on PR: ✓ Enabled
* AI PR reviews: ✓ Enabled
* Post PR comments: ✓ Enabled

### PR Build Status

CodeThreat updates pull request build status:

* ✅ **Successful**: No critical/high vulnerabilities
* ❌ **Failed**: Security issues found
* ⏳ **In Progress**: Scanning

***

## Best Practices

* Use OAuth for simpler setup
* Connect at workspace level for teams
* Enable PR scanning
* Set merge checks to require security scans

***

## Troubleshooting

**Connection failed**:

* Verify app password permissions are correct
* Check username is your Bitbucket username (not email)
* Ensure workspace access granted (for OAuth)

**Repositories not showing**:

* Verify you have Read access to repositories
* Check workspace is correctly selected
* Re-authorize the connection

**Webhook not triggering**:

* Check webhook delivery history in Bitbucket
* Verify webhook is active
* Ensure outbound HTTPS is allowed

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Run Your First Scan" icon="play" href="/scanning/running-scans">
    Start scanning Bitbucket repositories
  </Card>

  <Card title="PR Scanning" icon="code-pull-request" href="/scanning/pr-scanning">
    Get security feedback on pull requests
  </Card>
</CardGroup>