Bitbucket Cloud integration docs reference OAuth Consumers, but Bitbucket Cloud only provides OAuth

SonarQube Server / Community Build
1

Bitbucket Cloud integration documentation appears outdated (OAuth Consumer no longer available)

Versions

  • SonarQube Server 2025.1
  • SonarQube Server 2026.1

Deployment

  • Docker

What are you trying to achieve?

I am trying to configure Bitbucket Cloud integration so that SonarQube can decorate Pull Requests with Quality Gate results and code quality information.

I am following the SonarQube documentation:

The documentation instructs users to:

  • Create an OAuth Consumer
  • Mark it as a private consumer
  • Configure the OAuth Consumer key and secret in SonarQube

What have you tried so far?

I attempted to follow the documentation in Bitbucket Cloud Workspace Settings.

However, I cannot find an “OAuth Consumers” section anymore.

My Bitbucket Cloud workspace only provides:

  • OAuth Clients

The UI no longer appears to offer:

  • OAuth Consumers
  • “This is a private consumer”

I also reviewed the current Atlassian documentation:

I suspect the older Atlassian OAuth Consumer documentation may no longer reflect the current Bitbucket Cloud UI:

Using OAuth Client’s won’t work:

image
image1548×211 18.9 KB

Questions

  1. Is the SonarQube Bitbucket Cloud documentation outdated and still referencing a legacy Bitbucket Cloud feature?
  2. Should SonarQube now be configured using Bitbucket OAuth Clients instead of OAuth Consumers?
  3. If OAuth Clients are the correct approach, which grant types and scopes are required?
  4. Has anyone successfully configured Bitbucket Cloud Pull Request decoration using SonarQube Server 2025.1 or 2026.1 with the current Bitbucket Cloud UI?

Observed behavior

The SonarQube documentation requires an OAuth Consumer and references a “private consumer” setting.

In the current Bitbucket Cloud workspace UI, neither of these options appear to exist. Only OAuth Clients can be created.

Because of this, it is unclear how the documented configuration maps to the current Bitbucket Cloud authentication model.

Any clarification from SonarSource would be appreciated.

2

Hey @FabianSchurig, welcome to the Community!

You’re right, our docs and our in-product guidance seem to be behind Bitbucket Cloud’s current UI.

  • OAuth Consumer should be OAuth Client.
  • OAuth Key should be Client ID.
  • OAuth Secret should be Secret.

For the client authorization settings, enable Client credentials. Authorization code and Refresh token are not required for this integration. Ensure the client has “Pull requests: Read” permission, then configure those credentials under Administration > Configuration > General Settings > DevOps Platform Integrations > Bitbucket Cloud.

We are tracking the field-name mismatch internally, I will let the team know that some users are starting to notice :grin:

5

Hi! Having the same problem. Set this up according to the latest instructions here, but still getting the same error. Using SonarQube Server v2025.1.1. Is it working for others?

6

Hello @JuhaU, your message reporting the same issue as @FabianSchurig actually made me realize that you’re both running into a known issue. Bitbucket changed the OAuth token field from scopes to scope, and we patched our versions of SonarQube accordingly. If running 2025.1, you need to make sure to be at least on 2025.1.8, and if running 2026.1, you need to be 2026.1.3. In case anyone reading this is on 2025.4 (which is also LTA), then you need to patch it to 2025.4.7.

By the way, and simply for your information, we have a knowledge article covering exactly this known issue (to read it, you need to create an account in our Help Center).

10

OK, thanks Andrés, this is the issue. If the docs are anyways to be updated, could mention also this version limitation?

11

@JuhaU glad to hear the issue is solved! I’ll leave it up to the docs team to decide if they want to mention it, because, although it might prevent cases like this, we typically expect users to be on the latest patch version (as patch updates are lower-friction than major/minor updates).