# Bitbucket Pipelines cannot push to protected master branch using repository access token

**URL:** <https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546>\
**Category:** Bitbucket Cloud\
**Tags:** bitbucket-pipelines\
**Created:** [January 21, 2026, 12:10pm UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546 "2026-01-21T12:10:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PauCastellanoRioja](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@PauCastellanoRioja](https://community.developer.atlassian.com/u/PauCastellanoRioja)\
**Post date:** [January 21, 2026, 12:10pm UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546/1 "2026-01-21T12:10:49Z")

</div>

Hi everyone,

I’m configuring **Bitbucket Pipelines** to perform **automated semantic versioning and releases**.

### Context

- Repository hosted on **Bitbucket Cloud**

- `master` branch is **protected** :

- This protection is intentional and should remain in place

### What the pipeline does

After a PR is merged into `master`, the pipeline:

1. Computes the next semantic version

2. Updates a version file (e.g. ` __version__ `)

3. Creates a new commit with the version bump

4. Attempts to push that commit back to `master`

5. Creates and pushes a Git tag

### Authentication setup

- Git operations use **SSH** (`git@bitbucket.org:workspace/repo.git`)

- I’ve created a **repository-level access token** and exposed it to the pipeline

- Token scopes include:

### Problem

The pipeline can:

- Clone and fetch the repository successfully

But when it tries to push the version bump commit to `master`, it fails with:

```bash
remote: Permission denied to update branch master.
! [remote rejected] master -> master (pre-receive hook declined)

```

### Questions

1. **Is it actually possible** for Bitbucket Pipelines to push commits directly to a protected branch like `master`, even with a repository access token that has `repository:write`?

2. Do repository access tokens **bypass branch restrictions** , or are branch restrictions always enforced regardless of token scopes?

3. Is the intended solution to:

4. Is there a **recommended or cleaner approach** for implementing automated version bumps on protected branches in Bitbucket Cloud?

I want to keep `master` protected, but still allow fully automated releases without manual intervention.

Thanks in advance for any guidance.

Best regards,  
Pau

**EDIT:** Currently I’ve solved it by toggling branch restrictions via API in the release script, but I don’t think this is a valid permanent solution (neither an elegant one).

---

<div class="post-metadata">

**Author:** ![ChaimPaperman](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/chaimpaperman/32/55866_2.png) [@ChaimPaperman](https://community.developer.atlassian.com/u/ChaimPaperman)\
**Post date:** [June 4, 2026, 3:07am UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546/2 "2026-06-04T03:07:21Z")

</div>

@PauCastellanoRioja did you end up figuring this out? I have the same issue (thank you for spelling it out so clearly)

---

<div class="post-metadata">

**Author:** ![Renato](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@Renato](https://community.developer.atlassian.com/u/Renato)\
**Post date:** [June 4, 2026, 3:27am UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546/3 "2026-06-04T03:27:50Z")

</div>

Hi @ChaimPaperman ,

There is an open issue about branch restrictions and access tokens: [BCLOUD-22400](https://jira.atlassian.com/browse/BCLOUD-22400).

You can try using user [API tokens](https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/) as they work with branch permissions, and probably the main downside being that it is tied to an user account.

---

<div class="post-metadata">

**Author:** ![PauCastellanoRioja](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@PauCastellanoRioja](https://community.developer.atlassian.com/u/PauCastellanoRioja)\
**Post date:** [June 22, 2026, 1:08pm UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546/4 "2026-06-22T13:08:11Z")

</div>

Currently I’ve solved it by toggling branch restrictions via API in the release script, but I don’t think this is a valid permanent solution (neither an elegant one).

---

<div class="post-metadata">

**Author:** ![ChaimPaperman](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/chaimpaperman/32/55866_2.png) [@ChaimPaperman](https://community.developer.atlassian.com/u/ChaimPaperman)\
**Post date:** [June 22, 2026, 2:09pm UTC](https://community.developer.atlassian.com/t/bitbucket-pipelines-cannot-push-to-protected-master-branch-using-repository-access-token/98546/5 "2026-06-22T14:09:53Z")

</div>

Thank you - we thought about doing that but as you mentioned it’s not a valid permanent solution.