How to fix remote: You don't have permission to push to this branch in Git

The standard workflow for protected branches is to use pull requests:

# Create a feature branch from your current changes
git checkout -b feature/your-changes

# If you already committed to the protected branch, reset it
# and move your commits to the feature branch
git checkout main
git reset --hard origin/main
git checkout feature/your-changes

# Push the feature branch
git push -u origin feature/your-changes

Then create a pull request in Bitbucket:
1. Go to your repository on Bitbucket
2. Click Create pull request
3. Select your feature branch as source and the protected branch as destination
4. Add reviewers and submit the PR

This is the intended workflow when branch protection is enabled.

Review the branch permissions to understand what's blocking you:

For Bitbucket Cloud:
1. Go to your repository on Bitbucket
2. Navigate to Repository settings > Branch restrictions
3. Find the rule for your target branch (e.g., main, master, develop)
4. Click Edit to see the current restrictions

For Bitbucket Data Center/Server:
1. Go to the repository or project settings
2. Navigate to Branch permissions
3. Review the restrictions for your target branch

Look for these settings:
- Prevent changes without a pull request - Requires PR workflow
- Write access - Shows who can push directly
- Prevent rewriting history - Blocks force push/rebase

If you need to push directly to the protected branch, ask an administrator to add you:

For Bitbucket Cloud:
1. Admin goes to Repository settings > Branch restrictions
2. Edit the branch restriction rule
3. In Write access section, select "Only specific people or groups have write access"
4. Add your username or your team/group
5. Click Save

For Bitbucket Data Center/Server:
1. Admin goes to Branch permissions
2. Click Add permission or edit existing rule
3. Add your user or group as an exemption to the restriction
4. Save the changes

Note: Being added as an exemption means the restriction will not apply to you, allowing direct pushes.

Bitbucket branch restrictions currently don't work well with access tokens. Switch to SSH authentication:

Step 1: Generate an SSH key (if needed)

# Generate a new SSH key
ssh-keygen -t ed25519 -C "your_email@example.com"

# Start the SSH agent
eval "$(ssh-agent -s)"

# Add your key to the agent
ssh-add ~/.ssh/id_ed25519

Step 2: Add the key to your Bitbucket account
1. Copy your public key: cat ~/.ssh/id_ed25519.pub
2. Go to Personal Bitbucket settings > SSH keys
3. Click Add key and paste your public key
4. Save

Step 3: Update your repository to use SSH

# Check current remote URL
git remote -v

# Change to SSH URL
git remote set-url origin git@bitbucket.org:workspace/repository.git

# Verify the change
git remote -v

Important: Add the SSH key to your personal account, not to the workspace or repository level. Repository-level keys are read-only.

Ensure your SSH configuration properly identifies to Bitbucket:

Edit ~/.ssh/config:

Host bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes
    IdentitiesOnly yes

Test the connection:

ssh -T git@bitbucket.org

You should see a message like:

authenticated via ssh key.
You can use git to connect to Bitbucket.

If you see your username in the response, SSH is correctly configured. If not, the wrong key may be offered.

If you're trying to force push (e.g., after a rebase), you need additional permissions:

For Bitbucket Cloud:
1. Admin goes to Repository settings > Branch restrictions
2. Edit the branch restriction rule
3. Check Allow rewriting branch history
4. Save changes

For Bitbucket Data Center/Server:
1. Admin edits the branch permission
2. Ensure "Prevent rewriting history" is not enabled, or add your user as an exemption

Alternative: Avoid force push

# Instead of rebasing, merge to avoid force push
git checkout feature-branch
git merge main
git push origin feature-branch

# Then update your PR - it will now include the merge commit

Force pushing to shared branches is generally discouraged as it can disrupt other developers.

If your CI/CD pipeline needs to push (e.g., version bumps, changelog updates):

Option 1: Use a deployment SSH key
1. Generate a dedicated SSH key for CI/CD
2. Add it to Bitbucket:
- For Bitbucket Cloud: Add to repository Access keys with write access
- Or add to the workspace SSH keys for broader access
3. Configure your CI to use this key
4. Add the CI user to branch restriction exemptions

For Bitbucket Pipelines:

pipelines:
  default:
    - step:
        script:
          - git push origin main
        # Pipeline has its own SSH key - ensure it's allowed in branch restrictions

Option 2: Use App password (for HTTPS)
1. Create an App password in Personal settings
2. Grant Repository Read/Write permissions
3. Use in CI as: https://username:app_password@bitbucket.org/...
4. Note: May still be blocked by branch restrictions

Option 3: Modify workflow to use PRs
Have CI create a PR instead of pushing directly:

# Create branch and push
git checkout -b release/v1.2.3
git push -u origin release/v1.2.3

# Use Bitbucket API to create PR
curl -X POST -H "Authorization: Bearer $BB_TOKEN" \
  "https://api.bitbucket.org/2.0/repositories/workspace/repo/pullrequests" \
  -d '{"title": "Release v1.2.3", "source": {"branch": {"name": "release/v1.2.3"}}}'

If Git is authenticating with the wrong Bitbucket account:

On Windows (Credential Manager):
1. Open Control Panel > Credential Manager > Windows Credentials
2. Find entries for git:https://bitbucket.org or bitbucket.org
3. Click Remove to delete cached credentials

Or via command line:

cmdkey /delete:git:https://bitbucket.org

On macOS (Keychain):

# Remove Bitbucket credentials from Keychain
git credential-osxkeychain erase
host=bitbucket.org
protocol=https
# Press Enter twice

On Linux:

# If using store helper
grep -v bitbucket.org ~/.git-credentials > temp && mv temp ~/.git-credentials

# If using cache helper
git credential-cache exit

After clearing credentials, Git will prompt for authentication on the next push.