I have worked out to set a new team in concourse ci and can login as Bitbucket users.

```
fly set-team -n main \
  --basic-auth-username myuser \
  --basic-auth-password xxxx \
  --generic-oauth-display-name bitbucket \
  --generic-oauth-client-id xxxx  \
  --generic-oauth-client-secret xxxx \
  --generic-oauth-auth-url https://bitbucket.org/site/oauth2/authorize \
  --generic-oauth-token-url https://bitbucket.org/site/oauth2/access_token 

```

The key to set it successfully is, callback url for OAuth consumer in bitbucket need be concourse ci web site only (no `/auth/oauth/callback` in callback url)

Now I found a problem. Any users (even new registered free user in bitbucket cloud) can login my concourse ci server.

After did some research, I got this

> 
> Generic oAuth
> 
> 
> The --generic-oauth-\* flags configure a generic oAuth provider which performs no additional verification about the individual user signing in by default. It should only be used with internal auth systems in this way. If it were used to configure Google or Twitter oAuth, for example, **it would permit just about every person on the internet to create pipelines**. It'd be mighty generous. If you need verification, make sure you are using the --generic-oauth-scope flag.
> 
> 
> 

So are there any ways to stop the unauthorised bitbucket cloud users to login, which should be only limit to my organisation? Same as github's option `--github-auth-organization=ORG`

I try to add  `--generic-oauth-scope concourse.main` But always get the error:

```
failed to verify token

```

I also read [OAuth on Bitbucket Cloud - Scopes](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html#OAuthonBitbucketCloud-Scopes) and try with most scopes, such as

```
--generic-oauth-scope account

```

Still get same error.

What should I put in the scope?