2. Short-lived build container tokens

From Bitbucket Archives - Inside Atlassian - More Control Over Permissions in Bitbucket Pipelines: New Features and Upcoming Changes by atlassian.com

2. Short-lived build container tokens

Each step provides a short-lived OAuth token through the BITBUCKET_OAUTH_TOKEN environment variable. The token is isolated to the build container, limited to the repository running the pipeline, and valid only while the step runs. When you configure auth.system.scopes, the token receives those permissions, plus read:git:bitbucket automatically when cloning is enabled. Steps without an auth block retain broad default permissions until Apr 30, 2027