Cannot add SSH key using OAuth

I am trying to write a script to provision developer virtual machines with their BitBucket account. The idea is to generate an SSH key on the VM, then attach this key to their account using the OAuth flow, since I need OAuth access anyway to create repositories.

So what I desire is a single form of authentication which can be used to enable the following:

• Creation of new repositories
• Cloning of repositories using the git clone git@... command provided by the clone buttons on the BitBucket UI

So my request is to either provide an OAuth scope which allows it to add SSH keys, or make (a subset of) the API available through SSH. I'd prefer the latter, but that seems less likely to happen.

My problem is that I now need to prompt the user to:

1. Go through the OAuth flow
2. Add a generated SSH key to their account manually

I'd like to reduce this to one step instead of two, which used to be possible with the v1 API. However authenticating with username/password for the v1 API is no longer possible for users who have enabled 2 factor authentication, and I'd rather not store passwords at all.

An alternative would be to enable app passwords for users who do not have 2 factor auth enabled. This could also lead to a consistent experience.