Bitbucket Cloud OAuth: consent screen shown on every authorization, consent no longer remembered

Bitbucket Development Bitbucket Cloud
,
1

We run a CI/preview-environment product that uses Bitbucket Cloud OAuth 2.0 (authorization code grant) for user login. Starting around late July 2026, users report that they are shown the Atlassian consent screen on every single authorization, rather than being redirected straight through after the first grant.

Expected

After a user grants access once, subsequent authorization requests for the same consumer and the same user redirect immediately to our callback without re-displaying the consent screen. This is how it behaved previously, and it is how GitHub and GitLab OAuth behave in the same application today.

Actual

Every authorization request renders the full " is requesting access to your Atlassian account" consent page with the complete scope list. Accepting it works correctly, but the next authorization prompts again.

Reproduction

  1. Revoke the app in your Atlassian account
  2. Open the authorize url for your oauth app, which looks like https://bitbucket.org/site/oauth2/authorize?client_id=KEY&response_type=code...
  3. Click Accept
  4. Open the same URL again

Step 4 shows the consent screen a second time

What we have ruled out

  • PKCE. We tested with and without code_challenge / code_challenge_method=S256. Both re-prompt identically.
  • state. Tested with and without. No difference.
  • prompt parameter. We do not send prompt in the authorization request.
  • Token or refresh failures. Our logs show no failures at https://bitbucket.org/site/oauth2/access_token. Nothing is being rejected; each authorization succeeds cleanly.
  • Org authentication policy. Idle session duration is at the default of 30 days, not a shortened value.
  • A single consumer or deployment. Reproduced on two independent deployments with separate OAuth consumers and separate Atlassian accounts.
  • Our OAuth client generally. GitHub and GitLab logins in the same application still skip consent on repeat authorizations.

Environment

  • Bitbucket Cloud
  • OAuth 2.0 authorization code grant
  • Confidential client (client secret sent via HTTP Basic to the token endpoint)
  • Authorization endpoint: https://bitbucket

Questions

  1. Is consent no longer persisted for Bitbucket Cloud OAuth consumers? If so,
    is this intentional, and was it announced anywhere?
  2. Is this related to the OAuth 2.0 changes enforced on May 4, 2026?
  3. Is there a supported way to request silent re-authorization when a valid
    grant already exists (for example a prompt=none equivalent)?