As mentioned here: Unable to set up repositories on Bitbucket Org
How does Drone then gets the credentials to clone repositories in the pipeline when triggered by the webhooks? Does the webhook provide the requirements/permissionz?
my understanding is that Drone keeps the OAuth token from the user that activated the repo, so drone is able to pull the code on your behalf by injecting this credentials to the pipeline you can se here how