Bitbucket: "Repository access denied. access via a deployment key is read-only."
Bitbucket Cloud has two places for an SSH key. A key under your account's SSH keys acts as you, with your permissions. A key under a repository's Access keys (the old name was deployment key) gives read-only access to that one repository, as Atlassian's page on access keys says. Clone and fetch work with it; git push stops with this message. So the fix is not a permission on the repository but which key ssh offers, and where that key is registered (the Stack Overflow question on it has been seen over 170,000 times).
While git push is refused: Pull Request Inbox for Bitbucket, a plugin for JetBrains IDEs, talks to Bitbucket's REST API with your Atlassian e-mail and an API token, not over SSH, so the review inbox, diffs and discussions keep working. Get it on JetBrains Marketplace
What it looks like
repository access denied. access via a deployment key is read-only.thenfatal: Could not read from remote repository.- It comes on push, or on anything else that writes, such as pushing a tag or deleting a branch. Clone, fetch and pull with the same key keep working, which is why it often shows up only later.
See which key ssh used
ssh -vT git@bitbucket.org(orssh.bitbucket.org, if your remote uses it) prints the key files ssh offered and the one the server accepted.ssh-add -llists the keys your agent holds; an agent tries them before the file you meant.- If the accepted key is on a repository's Access keys, that is the cause. One answer clears the agent with
ssh-add -D, adds only the right key withssh-add, and checks again withssh -vT.
Move the key to your account
- In Bitbucket, open Personal Bitbucket settings, then SSH keys, and add the public key there (the accepted answer). To use the same key, remove it from the repository's Access keys first and then add it to your account, as another answer does.
- If the access key is there for a server that only reads, such as a deploy target, leave it and give your own machine a separate key on your account. With several keys on one machine, a
Hostentry per key in~/.ssh/configwithIdentityFileandIdentitiesOnly yeskeeps ssh from offering the wrong one (Atlassian's page on several keys on one device).
Pushing from Bitbucket Pipelines
- A pipeline's default origin is HTTP, and Atlassian says pushing back over it works as it is (Atlassian's page on pushing back). This message appears when a script switched the origin to SSH, for example with
${BITBUCKET_GIT_SSH_ORIGIN}, and the key it uses is only an access key. - For SSH, Atlassian's steps generate a key under the repository's Pipelines SSH keys and add its public key to Personal Bitbucket settings, SSH keys. Or push over HTTPS with an API token that has the
write:repository:bitbucketscope. Put[skip ci]in the commit message so the push does not start the pipeline again.
Pushing from another CI server
- Jenkins and similar servers are often given an access key, which is right for checkout and wrong for pushing tags or version bumps back. Give the job a credential that can write: an SSH key on a Bitbucket account meant for the build, or an access token with write permission over HTTPS.
Bitbucket pull requests in IntelliJ IDEA
Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, reads the workspace and repository from your git remote, SSH or HTTPS, ssh.bitbucket.org included, and talks to Bitbucket's REST API with your Atlassian e-mail and an API token, not over SSH. So the review inbox, diffs and discussions keep working while git's SSH is failing. They are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).
Get it on JetBrains Marketplace
Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o.; Jenkins is a trademark of LF Charities Inc. This page is not affiliated with or endorsed by any of them.
More: "Permission denied (publickey)" · "You may not have access to this repository" · Bitbucket Cloud SSH moves to ssh.bitbucket.org · 日本語