# Bitbucket (/docs/integrations/bitbucket) Trace connects to Bitbucket Cloud through a [Forge](https://developer.atlassian.com/platform/forge/) app named **Trace**: Atlassian's supported platform for workspace-level apps. Install the app in your workspace, pair it with your Trace organization using a one-time code, and your repositories sync into the dashboard ready for testing. How it works [#how-it-works] 1. **Install the Trace app.** Open the install link provided during your Trace onboarding and install the app into your Bitbucket workspace. Workspace admin permissions are required. (Trace is distributed via a private sharing link, not the Atlassian Marketplace.) 2. **Get the pairing code.** In Bitbucket, open your workspace settings and select the **Trace** app page. It displays a one-time pairing code, visible only to workspace admins. 3. **Pair the workspace.** In the Trace dashboard, go to **Settings → Integrations → Bitbucket**, click **Connect workspace**, and enter the code. The pairing code is how you prove control of the workspace: it binds the installation to your Trace organization, and nothing else can. 4. **Repositories sync.** Trace lists the workspace's repositories and they appear in your dashboard. If the workspace's repository list changes later, use **Re-sync repositories** on the connection. Using Bitbucket repositories [#using-bitbucket-repositories] Once paired, the workspace's repositories are available in Trace as sources for penetration tests, exactly like GitHub repositories. When you run an engagement against an application backed by a Bitbucket repository, Trace clones it into an isolated, ephemeral environment for the duration of the test and destroys it afterwards. See the [Pentest overview](/docs/pentest/overview) for how engagements work. What Trace can access [#what-trace-can-access] The Trace app requests two **read-only** scopes: * `read:repository:bitbucket`, list and clone the workspace's repositories for testing * `read:workspace:bitbucket`, resolve the workspace's identity when pairing Trace never holds standing Bitbucket credentials. Access tokens are short-lived (issued by Atlassian, \~4-hour lifetime) and requested just-in-time for each engagement. The handoff transits a single-use, KMS-encrypted exchange that is deleted the moment the clone picks it up (seconds-lived, with a 60-second hard expiry), and the decrypted token lives only in memory for the duration of the clone. There is no app password, no OAuth consumer, and no personal access token involved. Disconnecting [#disconnecting] Uninstall the Trace app from your Bitbucket workspace settings. Engagements on its repositories stop resolving credentials immediately; the connection shows as inactive in Trace as soon as the uninstall signal arrives, or at the latest on the next clone attempt. Reinstalling the app resets the pairing, open the Trace app page in the workspace for a fresh code and pair again. Current limitations [#current-limitations] * **Bitbucket Cloud only.** Bitbucket Data Center and Server are not supported (Forge apps exist only on Cloud). * **Workspace-wide access.** Forge apps install at the workspace level; per-repository install granularity is not part of the Bitbucket model.