We have two http access tokens in a repository. We assumed that each token would receive it's own rate limiting bucket and that different tokens in a specific repository would not step on each other. However, while investigating why one script was receiving 429s, we discovered that the tokens are identified and handled by rate limiting per token scope.

As an example, the tokens appear to be a user "access-token-user/2/1" or "access-token-user/1/1".

Broken down, this scoping appears to be an composite of the following details:

• Key type: access-token-user == HTTP Access Token, access-key-user == SSH Key
• Key scope: 1 == Project level, 2 == Repository level
• Source identifier: Either the Project ID or the Repository ID

So this means that multiple keys are grouped together, at least as far as rate-limiting is concerned. 

• Multiple SSH keys defined at a Project level with a Project ID of 5 would result in a combined rate-limited identity of "access-key-user/1/5".
• Multiple HTTP keys defined at a Repository level with a Repository ID of 299 would result in a combined rate-limited identity of "access-token-user/2/299".

We assume that each token would be bucketed separately and we'd like to formally ask for Bitbucket's rate-limiting to NOT group keys up by identity like this.