Your agency has asked for access to Bitbucket. You don't need to share your password for it. Bitbucket lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against Bitbucket's own help pages in November 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. Write is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| Write | Pushes code directly and works on pull requests. Cannot change repository settings. | Usually the right one |
| Admin | Everything in the repository, including its settings, permissions and deleting it. | If the work needs it |
| Read | Views, clones and forks the code. Cannot push changes. | If the work needs it |
Add your agency to Bitbucket
- Open your repository on Bitbucket. Next to its name in the left sidebar, select More actions (...), then Settings.
- Select Repository permissions, then Add users or groups.
- Enter your agency's email address, set the permissions dropdown to Write and select Confirm.
Your agency takes a user on your plan: Free allows 5, and Standard and Premium charge per user. If Bitbucket won't take an email address here, invite your agency's email address first from User management under the Settings cog, then add it here.
How you both know it worked
Bitbucket emails your agency an invitation from id.atlassian.net. Once they accept it, they show in your Bitbucket account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- On Bitbucket, select the Settings cog at the top, then Workspace settings, then User directory under Access management.
- In the Actions column, select the three dots next to your agency's account, then Remove.
- In the settings of your repository, delete any access keys or access tokens your agency added.
Do you have to share your password?
No. Every step above uses Bitbucket's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one GetSetKeys link instead of a page like this. It walks the client through Bitbucket and the other platforms the project needs, and checks that each step is done.