Fix Bitbucket SSH: Permission Denied & ssh.bitbucket.org Migration

Bitbucket Cloud is splitting traffic: bitbucket.org now strictly serves HTTPS web and API requests, while Git SSH operations (clone, pull, push) must target ssh.bitbucket.org.

To make sure nobody sleeps through the deadline, Atlassian is running scheduled brownouts starting November 12, 2026 (I was today years old when I learned what a brownout in tech actually means: intentionally breaking production in short bursts so engineers stop ignoring deprecation notices before the December 10 cutoff).

When the brownout hits, your terminal will show:

git@bitbucket.org: Permission denied (publickey).
fatal: Could not read from remote repository.

Or ssh: connect to host bitbucket.org port 22: Connection refused.

Instead of rewriting remotes across dozens of local repos, here is how to fix it cleanly across macOS, Linux, WSL, and Windows.

Fix 1: Global SSH config alias (Recommended)

Add this block to your ~/.ssh/config (or C:\Users\<you>\.ssh\config on Windows). It silently routes legacy bitbucket.org calls to ssh.bitbucket.org without editing individual repository remotes:

Host bitbucket.org ssh.bitbucket.org
    HostName ssh.bitbucket.org
    User git
    # IdentityFile ~/.ssh/your_key  # if using a custom key

Fix 2: Global Git URL rewrite

If you don't use ~/.ssh/config, tell Git to rewrite the hostname globally:

git config --global url."git@ssh.bitbucket.org:".insteadOf "git@bitbucket.org:"

Fix 3: Update a single remote

git remote set-url origin git@ssh.bitbucket.org:workspace/repo.git

Verify

ssh -Tv git@ssh.bitbucket.org

The first connection prompts to trust the host key. Accept it (yes), and your existing keys will authenticate as usual.