diff --git a/README.md b/README.md
index b400041..9966b69 100644
--- a/README.md
+++ b/README.md
@@ -76,14 +76,20 @@ docker run --rm --name erlangbuilder -v ${PWD}:/bec  -w=/bec  erlang rebar3 escr
 
 ## Sample BitBucket Configuration
 
+BEC supports both Basic Authentication (via username/password) and Token-Based Authentication (preferred).
+If both a `token` and a `username/password` pair are provided, the token will take precedence.
+
 Set BitBucket url and credentials in `bitbucket.config`:
 
 ```
 {bitbucket_url, "https://my.bitbucket.server"}.
 {bitbucket_username, "first.last"}.
 {bitbucket_password, "password"}.
+{bitbucket_token, "someToken"}.
 ```
 
+Please follow [this](https://confluence.atlassian.com/bitbucketserver072/personal-access-tokens-1005335924.html#Personalaccesstokens-Generatingpersonalaccesstokens) guide if you want to generate the token to authenticate.
+
 ## Sample Repo Configuration
 
 You can find a sample configuration file for a custom BitBucket repo
diff --git a/sample_repo_configuration.yml b/sample_repo_configuration.yml
index b0965da..2776a68 100644
--- a/sample_repo_configuration.yml
+++ b/sample_repo_configuration.yml
@@ -91,6 +91,7 @@ pr-restrictions:
   required-all-tasks-complete: true
   required-approvers: 2
   required-successful-builds: 1
+  unapprove-on-update: true
   merge-config:
     default-strategy: no-ff
     enabled-strategies:
diff --git a/src/.vscode/settings.json b/src/.vscode/settings.json
new file mode 100644
index 0000000..7a73a41
--- /dev/null
+++ b/src/.vscode/settings.json
@@ -0,0 +1,2 @@
+{
+}
\ No newline at end of file
diff --git a/src/bec_pr_restriction_t.erl b/src/bec_pr_restriction_t.erl
index e72ddba..91da259 100644
--- a/src/bec_pr_restriction_t.erl
+++ b/src/bec_pr_restriction_t.erl
@@ -18,6 +18,7 @@
                         , 'required-all-tasks-complete' := boolean()
                         , 'required-approvers'          := integer()
                         , 'required-successful-builds'  := boolean()
+                        , 'unapprove-on-update'         := boolean()
                         }.
 
 %%==============================================================================
@@ -35,12 +36,14 @@ from_map(#{ <<"mergeConfig">>              := MergeConfig
           , <<"requiredAllTasksComplete">> := RequiredAllTasksComplete
           , <<"requiredApprovers">>        := RequiresApprovers
           , <<"requiredSuccessfulBuilds">> := RequiredSuccessfulBuilds
+          , <<"unapproveOnUpdate">>        := UnapproveOnUpdate
           }) ->
   #{ 'merge-config'                => bec_merge_config_t:from_map(MergeConfig)
    , 'required-all-approvers'      => RequiredAllApprovers
    , 'required-all-tasks-complete' => RequiredAllTasksComplete
    , 'required-approvers'          => RequiresApprovers
    , 'required-successful-builds'  => RequiredSuccessfulBuilds
+   , 'unapprove-on-update'         => UnapproveOnUpdate
    }.
 
 -spec to_map(restriction()) -> map().
@@ -49,10 +52,12 @@ to_map(#{ 'merge-config'                := MergeConfig
         , 'required-all-tasks-complete' := RequiredAllTasksComplete
         , 'required-approvers'          := RequiresApprovers
         , 'required-successful-builds'  := RequiredSuccessfulBuilds
+        , 'unapprove-on-update'         := UnapproveOnUpdate
         }) ->
   #{ <<"mergeConfig">>              => bec_merge_config_t:to_map(MergeConfig)
    , <<"requiredAllApprovers">>     => RequiredAllApprovers
    , <<"requiredAllTasksComplete">> => RequiredAllTasksComplete
    , <<"requiredApprovers">>        => RequiresApprovers
    , <<"requiredSuccessfulBuilds">> => RequiredSuccessfulBuilds
+   , <<"unapproveOnUpdate">>        => UnapproveOnUpdate
    }.
diff --git a/src/bitbucket_http.erl b/src/bitbucket_http.erl
index 3491d49..2bc82b1 100644
--- a/src/bitbucket_http.erl
+++ b/src/bitbucket_http.erl
@@ -103,14 +103,21 @@ do_http_request(Method, Request) ->
 
 -spec headers() -> [{string(), string()}].
 headers() ->
-  Username = application:get_env(bec, bitbucket_username, ""),
-  Password = application:get_env(bec, bitbucket_password, ""),
-  Credentials = base64:encode_to_string(Username ++ ":" ++ Password),
-  [
-    {"Authorization", "Basic " ++ Credentials}
-  , {"Accept",        "application/json"}
+  [ {"Authorization", authorization()}
+  , {"Accept", "application/json"}
   ].
 
+-spec authorization() -> string().
+authorization() ->
+  case application:get_env(bec, bitbucket_token, "") of
+    "" ->
+      Username = application:get_env(bec, bitbucket_username, ""),
+      Password = application:get_env(bec, bitbucket_password, ""),
+      "Basic " ++ base64:encode_to_string(Username ++ ":" ++ Password);
+    Token ->
+      "Bearer " ++ Token
+  end.
+
 -spec handle_result(httpc_result()) ->
         {ok, map()} | {ok, [map()]} | {error, any()}.
 handle_result({ok, {{_Ver, Status, _Phrase}, _H, Body}}) when Status =:= 200;
diff --git a/src/bitbucket_repo_config.erl b/src/bitbucket_repo_config.erl
index 5159288..293d277 100644
--- a/src/bitbucket_repo_config.erl
+++ b/src/bitbucket_repo_config.erl
@@ -15,6 +15,9 @@ verify(Path) ->
 -spec verify(string(), opts()) -> boolean().
 verify(Path, Options) ->
   case filename:extension(Path) of
+    ".yaml" ->
+      Config = read(Path),
+      do_verify(Options, Config);
     ".yml"  ->
       Config = read(Path),
       do_verify(Options, Config);
diff --git a/test/bec_proper_gen.erl b/test/bec_proper_gen.erl
index 4dcf482..dc710c0 100644
--- a/test/bec_proper_gen.erl
+++ b/test/bec_proper_gen.erl
@@ -216,13 +216,20 @@ path() ->
 %% PR Restrictions
 %%==============================================================================
 pr_restrictions() ->
-  ?LET( {MergeConfig, AllApprovers, AllTasks, Approvers, Builds}
-      , {merge_config(), bool(), bool(), nat(), nat()}
+  ?LET( { MergeConfig
+        , AllApprovers
+        , AllTasks
+        , Approvers
+        , Builds
+        , UnapproveOnUpdate
+        }
+      , {merge_config(), bool(), bool(), nat(), nat(), bool()}
       , #{ 'merge-config'                => MergeConfig
          , 'required-all-approvers'      => AllApprovers
          , 'required-all-tasks-complete' => AllTasks
          , 'required-approvers'          => Approvers
          , 'required-successful-builds'  => Builds
+         , 'unapprove-on-update'         => UnapproveOnUpdate
          }).
 
 merge_config() ->