ssh read/write access keys

[Everett Carter]

I am migrating from on prem to cloud bitbucket.  How do I create R/W acess keys ?

[Stephen Sifers]

Hello Everett,

Within Bitbucket cloud you’re going to have to complete a few steps to get your SSH key setup. There is a detailed guide to walk you through this process. You may find the guide at Set up an SSH key.

I hope this information proves helpful and you’re able to set up your cloud SSH keys.

Regards,
Stephen Sifers

[Daniil Penkin]

Just a little note in addition to @Stephen Sifers's reply: the access SSH key in Bitbucket Cloud only provides read-only access to the repo.

To make changes you'd need to act on behalf of some user (which might be a bot) and authenticate with one of the following: SSH key, OAuth token, password or app password.

Hope this helps.

Cheers,
Daniil

[Everett Carter]

Why this change ?  This change could be a show stopper for us!

[Everett Carter]

or teach my bots oauth

[Daniil Penkin]

Why this change?

It was always like that. Just to be clear, here's the difference between normal and access SSH keys:

• regular SSH keys are configured for a user. These keys are granted with all permissions that user has. So let's say you have write access to repo A and only read access to repo B – with any regular SSH key configured in your account you'll be able to pull and push to repo A but only pull from repo B.
• access SSH keys are in turn configured for a repository. These keys are granted only with read access to that specific repository, and nothing else. This also means that you can't use an SSH key that is already used elsewhere in Bitbucket. Such key can be used, for instance, by a CI server to clone the repo, but it can't be used to push anything back. This was always the case, there was never a way to configure a "headless" SSH key with write privilege.

Using OAuth authentication isn't actually too hard, take a look at this example. Note that authenticating with OAuth means that any actions will be performed on your behalf (as if you did it) with a constraint of the configured OAuth consumer scope.

Let me know if this helps.

Cheers,
Daniil