Bitbucket Pipelines and OpenID Connect: No more secret management - Inside Atlassian Skip to content AI that knows your business Connect people, knowledge, and work to move faster together Learn more Dismiss Bitbucket Pipelines and OpenID Connect: No more secret management Sign up now Dismiss Subscribe to our newsletter Research and insights on how teams can deliver results with AI. Email Address Sign up Thank you! Your time is valuable. We promise to send only what’s actually worth reading. Share on Facebook (Opens in new window) Facebook Share on X (Opens in new window) X Share on LinkedIn (Opens in new window) LinkedIn Share on Mail (Opens in new window) Mail Inside Atlassian Topics Back Topics Leadership Develop AI-empowered teams that deliver results Teamwork Proven methods and insights to help teams collaborate Innovation Put the future of work into practice Development Better ways to build and ship software How we build A look inside Atlassian’s approach to building apps and teams Browse all Explore posts for all topics AI at Work AI Research Apps Back Apps Rovo AI-powered apps – driven by your team’s knowledge Jira Flexible project management Confluence Knowledge, all in one place Loom Quick, async video updates Trello Organized & visualized work Bitbucket Source code and CI/CD Jira Service Management Deliver service at high velocity Browse all apps Explore posts for all Atlassian apps News Search Sign up now Dismiss Subscribe to our newsletter Research and insights on how teams can deliver results with AI. Email Address Sign up Thank you for subscribing. Your time is valuable. We promise to send only what’s actually worth reading. Topics Back Topics Leadership Develop AI-empowered teams that deliver results Teamwork Proven methods and insights to help teams collaborate Innovation Put the future of work into practice Development Better ways to build and ship software How we build A look inside Atlassian’s approach to building apps and teams Browse all Explore posts for all topics AI at Work AI Research Apps Back Apps Rovo AI-powered apps – driven by your team’s knowledge Jira Flexible project management Confluence Knowledge, all in one place Loom Quick, async video updates Trello Organized & visualized work Bitbucket Source code and CI/CD Jira Service Management Deliver service at high velocity Browse all apps Explore posts for all Atlassian apps News Subscribe Dismiss Subscribe to our newsletter Research and insights on how teams can deliver results with AI. Email Address Sign up Thank you for subscribing. Your time is valuable. We promise to send only what’s actually worth reading. Search Bitbucket Pipelines and OpenID Connect: No more secret management March 19, 2021 Bitbucket Bitbucket Pipelines now allows you to talk to your favorite third-party applications without an access token or secret. You no longer need to store your secrets in Bitbucket Pipelines. You can generate an OpenID Connect token in Bitbucket Pipelines, and use that to talk to any third-party application that supports OpenID Connect. Why use OpenID Connect? Traditionally, you add a secret as a variable and use it in the pipeline step to talk to a third-party or an external resource. Even though secrets are easy to get started with, they have some drawbacks. Secret management is a huge challenge when your secrets are stored in multiple applications, and secrets can leak into your logs if you have a bad script. Coarse-grained permissions are also a drawback to using secrets. With OpenID Connect you can give granular access based on the deployment environment, branch name, etc. How does it work? Setup To get started you need to first register Bitbucket Pipelines as an OpenID Connect provider in your third-party application. During the registration process, you will need the following details: Identity provider URL Audience You can find both of these details on the OpenID Connect settings page in your repository’s settings. After adding the provider, you need to set up the role and permission. Please refer to the third-party application’s documentation to understand the steps for registering, creating roles, and permissions. Most of the cloud computing platforms support OpenID Connect, and we have documentation for getting you started: Bitbucket Pipelines as OpenID Connect Provider Deploy to AWS using OpenID Connect Usage - step: name: Deploy to production deployment: Production oidc: true Enable OpenID Connect token generation for a step by setting the oidc attribute to true. Bitbucket Pipelines will generate a unique token to identify each step. You can then use this token to authenticate with the third-party application. The token is available as an environment variable BITBUCKET_STEP_OIDC_TOKEN. Bitbucket Pipes with OpenID support We have upgraded our AWS pipes to use the OpenID Connect token, so you no longer need to provide an access token to use a pipe. You only need to set up Bitbucket Pipelines as an OpenID Connect provider in AWS. The list of upgraded pipes is as follows: aws-cloudformation-deploy aws-cloudfront-invalidate aws-code-deploy aws-ecr-push-image aws-ecs-deploy aws-lambda-deploy aws-s3-deploy Enjoy secret-less CI/CD. About This Article Justin Thomas Share on Facebook (Opens in new window) Facebook Share on X (Opens in new window) X Share on LinkedIn (Opens in new window) LinkedIn Share on Mail (Opens in new window) Mail Subscribe for more Inside Atlassian Get insights like this in your inbox Sign up now Dismiss Subscribe to our newsletter Research and insights on how teams can deliver results with AI. Email Address Sign up Thank you! Your time is valuable. We promise to send only what’s actually worth reading. Related content Article in Bitbucket Third-party secrets are now supported in Bitbucket Pipelines Bitbucket Pipelines is excited to announce support for CI/CD third-party secrets – a powerful new feature that enables you to seamlessly retrieve secrets directly from your preferred secret store. This enhancement ensures your workflows remain efficient and secure. Now, you can set up your own integration and customize the utilization of your secrets to suit […] Article in Bitbucket Bitbucket Pipelines OIDC now supports multiple audiences Bitbucket Pipelines now supports multiple audiences in OIDC claims, so you can extend the suite of resource servers your pipelines integrate with without storing credentials in Bitbucket. Multiple audiences allows you to use a single identity token across multiple resources for cleaner, simpler workflows. Customising your audiences To customise your audiences, declare them under the […] Article in Bitbucket Announcing support for Docker BuildKit in Bitbucket Pipelines We are happy to announce that one of the top voted features for Bitbucket Pipelines, Docker BuildKit is now available. You can now build Docker images with the BuildKit utility. With BuildKit you can take advantage of the various features it provides like: Performance: BuildKit uses parallelism and caching internally to build images faster. Secrets: […] About the blog Company Careers Events Investor relations Atlassian Foundation Press kit Contact us Products Rovo Jira Jira Align Jira Service Management Confluence Loom Trello Bitbucket See all products Resources Technical support Purchasing & licensing Atlassian Community Team Playbook Knowledge base Marketplace My account Create support ticket Learn Partners Training & certification Documentation Developer resources Enterprise services See all resources Copyright 2026 Atlassian Privacy policy Terms Impressum English