golang-migrate/migrate · error

no password/app password

Error message

no password/app password

What it means

ErrNoAccessToken is returned by the bitbucket driver's Open when the URL has a username but no password component (u.User.Password() returns ok=false). Bitbucket basic auth needs both username and password (an app password). Exported sentinel error.

Source

Thrown at source/bitbucket/bitbucket.go:22

	"fmt"
	"io"
	nurl "net/url"
	"os"
	"path"
	"path/filepath"
	"strings"

	"github.com/golang-migrate/migrate/v4/source"
	"github.com/ktrysmt/go-bitbucket"
)

func init() {
	source.Register("bitbucket", &Bitbucket{})
}

var (
	ErrNoUserInfo             = fmt.Errorf("no username:password provided")
	ErrNoAccessToken          = fmt.Errorf("no password/app password")
	ErrInvalidRepo            = fmt.Errorf("invalid repo")
	ErrInvalidBitbucketClient = fmt.Errorf("expected *bitbucket.Client")
	ErrNoDir                  = fmt.Errorf("no directory")
)

type Bitbucket struct {
	config     *Config
	client     *bitbucket.Client
	migrations *source.Migrations
}

type Config struct {
	Owner string
	Repo  string
	Path  string
	Ref   string
}

View on GitHub (pinned to 01a9643f14)

Solutions

1. Add the app password after the colon: `bitbucket://user:app-password@owner/repo/path#ref`.
2. Check the env/secret variable feeding the URL is set and non-empty in the environment running migrate.
3. Generate a Bitbucket app password with repository read scope if you don't have one.
4. Guard in code with errors.Is(err, bitbucket.ErrNoAccessToken) and surface a credential-missing message.

Example fix

// before
url := fmt.Sprintf("bitbucket://%s@%s/%s", user, owner, repo) // no password
// after
url := fmt.Sprintf("bitbucket://%s:%s@%s/%s", user, appPassword, owner, repo)

u, _ := nurl.Parse(sourceURL)
if u != nil && u.User != nil {
    if _, ok := u.User.Password(); !ok {
        return fmt.Errorf("bitbucket URL has username %q but no password (app password)", u.User.Username())
    }
}

func hasURLPassword(u *nurl.URL) bool {
    if u == nil || u.User == nil {
        return false
    }
    p, ok := u.User.Password()
    return ok && p != ""
}

d, err := bitbucket.Open(url)
if errors.Is(err, bitbucket.ErrNoAccessToken) {
    return fmt.Errorf("missing app password in bitbucket source URL")
}

When it happens

Trigger: URLs like `bitbucket://user@owner/repo#ref` or `bitbucket://user:@owner/...` where the password is missing or empty; env var holding the app password is unset so the URL interpolates without the password.

Common situations: App password stored in env not exported in CI; colon omitted or password left blank in config; secret managers returning empty string; trailing whitespace trimmed away by URL parsing.

Related errors

• no username:password provided
• no password
• invalid repo
• no directory
• no access token

AI-assisted analysis of golang-migrate/migrate@01a9643f14 (2026-09-02). Data as JSON: /api/errors/01906e1353413cf2. Report an issue: GitHub.