@@ -280,7 +280,8 @@ USAGE
   $ apify create [actorName] [--git-repo <value>] [--json]
                  [-l javascript|js|typescript|ts|python|py]
                  [--omit-optional-deps] [--skip-dependency-install]
-                 [--skip-git-init] [--source apify|github] [-t <value>]
+                 [--skip-git-init] [--source apify|github|gitlab|bitbucket]
+                 [-t <value>]
                  [-u web-scraper|ai-agent|data-pipeline|browser-automation]
 
 ARGUMENTS
@@ -308,11 +309,11 @@ FLAGS
       --skip-git-init            Skip initializing a git
                                  repository in the Actor directory.
       --source=<option>          Where the Actor source
-                                 code will live. With "github", Apify creates the
-                                 repository on your connected GitHub account from
-                                 the template, clones it here, and creates an Actor
-                                 that builds from it.
-                                 <options: apify|github>
+                                 code will live. With a Git provider, Apify creates
+                                 the repository on your connected account from the
+                                 template, clones it here, and creates an Actor that
+                                 builds from it.
+                                 <options: apify|github|gitlab|bitbucket>
   -t, --template=<value>         Template for the
                                  Actor. If not provided, the command will prompt for
                                  it. Visit
 
@@ -9,7 +9,7 @@ import { cryptoRandomObjectId } from '@apify/utilities';
 
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Flags } from '../../lib/command-framework/flags.js';
-import { getConsoleUrl } from '../../lib/console-url.js';
+import { getConsoleIntegrationsUrl, getConsoleUrl } from '../../lib/console-url.js';
 import { AUTH_FILE_PATH } from '../../lib/consts.js';
 import { getBackend } from '../../lib/credentials.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
@@ -19,8 +19,6 @@ import { createLocalApiServer } from '../../lib/local-api-server.js';
 import { error, info, success } from '../../lib/outputs.js';
 import { getLocalUserInfo, getLoggedClient, tildify } from '../../lib/utils.js';
 
-const CONSOLE_INTEGRATIONS_PATH = '/settings/integrations';
-
 // When logging in against a local Console instance (local platform development), validate the token
 // against the local API rather than production.
 const LOCAL_API_BASE_URL = 'http://localhost:3333';
@@ -108,7 +106,7 @@ export class AuthLoginCommand extends ApifyCommand<typeof AuthLoginCommand> {
 
 		const consoleUrl = getConsoleUrl();
 		const consoleOrigin = new URL(consoleUrl).origin;
-		const consoleIntegrationsUrl = `${consoleUrl}${CONSOLE_INTEGRATIONS_PATH}`;
+		const consoleIntegrationsUrl = getConsoleIntegrationsUrl();
 
 		let selectedMethod = method;
 
 
@@ -140,7 +140,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 		}),
 		source: Flags.string({
 			description:
-				'Where the Actor source code will live. With "github", Apify creates the repository on your connected GitHub account from the template, clones it here, and creates an Actor that builds from it.',
+				'Where the Actor source code will live. With a Git provider, Apify creates the repository on your connected account from the template, clones it here, and creates an Actor that builds from it.',
 			choices: [...GIT_SOURCE_CHOICES],
 			// No default: an omitted flag triggers the wizard prompt, or "apify" when it cannot be asked.
 			required: false,
@@ -292,7 +292,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 		// Catches a non-interactive run that named a repository but omitted --source, which would
 		// otherwise silently take the Apify path.
 		if (!gitProvider && gitRepo) {
-			throw new Error('--git-repo only applies to a Git source, so add --source github or drop it.');
+			throw new Error('--git-repo only applies to a Git source, so add --source github|gitlab|bitbucket or drop it.');
 		}
 
 		// The platform only accepts archive URLs listed in the official manifest.
 
@@ -20,6 +20,29 @@ export function getConsoleUrl(): string {
 	return DEFAULT_CONSOLE_URL;
 }
 
+/** The fields of a stored login that decide which Apify account a Console URL opens. */
+export interface ConsoleAccount {
+	id?: string;
+	organizationOwnerUserId?: string;
+}
+
+/**
+ * The Console route an organization login has to run under. Console takes the account from the path, and
+ * where the path does not say it falls back to the account the browser was last on — so a bare URL can act
+ * on an account the CLI never asked for.
+ */
+export function getConsoleRoutePrefix(account?: ConsoleAccount): string | null {
+	return account?.organizationOwnerUserId && account.id ? `/organization/${account.id}` : null;
+}
+
+/**
+ * Where a user manages the accounts Apify is connected to, including the git providers. Pass the account
+ * whenever the page is opened to act on it, rather than only to be read.
+ */
+export function getConsoleIntegrationsUrl(account?: ConsoleAccount): string {
+	return `${getConsoleUrl()}${getConsoleRoutePrefix(account) ?? ''}/settings/integrations`;
+}
+
 function stripTrailingSlash(value: string): string {
 	return value.replace(/\/+$/, '');
 }
@@ -0,0 +1,115 @@
+import type { AddressInfo } from 'node:net';
+
+import computerName from 'computer-name';
+import open from 'open';
+
+import { cryptoRandomObjectId } from '@apify/utilities';
+
+import { type ConsoleAccount, getConsoleIntegrationsUrl, getConsoleUrl } from '../console-url.js';
+import { createLocalApiServer } from '../local-api-server.js';
+import { info } from '../outputs.js';
+import { cliDebugPrint } from '../utils/cliDebugPrint.js';
+import type { GitProvider } from './gitSource.js';
+
+// Matches the version `apify login` serves its loopback routes under; Console reads it from the
+// `localCliApiVersion` query param and builds the callback URL from it.
+const API_VERSION = 'v1';
+
+export const CONNECT_TIMEOUT_MS = 5 * 60_000;
+
+export type ConnectViaConsoleResult =
+	| { connected: true }
+	/** The caller stopped waiting — it learned of the connection another way. Nothing to report. */
+	| { abandoned: true }
+	| { stopReason: 'connectCancelled' | 'connectTimedOut'; message: string };
+
+/**
+ * Connects a git provider that the CLI cannot authorize on its own.
+ *
+ * GitHub is a public OAuth app, so the CLI builds its authorize URL directly. GitLab and Bitbucket are
+ * `UserIntegration` documents whose CSRF `state` is minted and stored server-side, so the browser has to
+ * start the flow. Console does that and reports back to a loopback server here, the same hand-off
+ * `apify login` uses.
+ *
+ * The caller re-reads the integration list afterwards, so the reported id is only logged.
+ */
+export const connectViaConsole = async (
+	provider: GitProvider,
+	label: string,
+	{ abortSignal, account }: { abortSignal?: AbortSignal; account?: ConsoleAccount } = {},
+): Promise<ConnectViaConsoleResult> => {
+	const consoleUrl = getConsoleUrl();
+	const authToken = cryptoRandomObjectId();
+
+	let resolve!: (result: ConnectViaConsoleResult) => void;
+	const finished = new Promise<ConnectViaConsoleResult>((resolveFinished) => {
+		resolve = resolveFinished;
+	});
+
+	const server = createLocalApiServer({
+		// Only the origin, matching `apify login`: it is compared against the browser's Origin header.
+		corsOrigin: new URL(consoleUrl).origin,
+		authToken,
+		routes: {
+			[`POST /api/${API_VERSION}/git-provider-connected`]: (body, res) => {
+				res.end();
+				cliDebugPrint('git-source', 'connected', body);
+				resolve({ connected: true });
+			},
+			[`POST /api/${API_VERSION}/exit`]: (body, res) => {
+				res.end();
+				resolve({
+					stopReason: 'connectCancelled',
+					message: body.isWindowClosed
+						? `Connecting your ${label} account stopped: the Apify Console window was closed.`
+						: `Connecting your ${label} account was canceled in Apify Console.`,
+				});
+			},
+		},
+	});
+
+	const timer = setTimeout(
+		() =>
+			resolve({
+				stopReason: 'connectTimedOut',
+				message: `Connecting your ${label} account did not finish within ${CONNECT_TIMEOUT_MS / 60_000} minutes.`,
+			}),
+		CONNECT_TIMEOUT_MS,
+	);
+
+	abortSignal?.addEventListener('abort', () => resolve({ abandoned: true }), { once: true });
+
+	// Port 0 assigns a random free port.
+	server.listen(0);
+	const { port } = server.address() as AddressInfo;
+
+	// Console creates the integration for the account its own route names, so the CLI has to name the one
+	// its token belongs to. Without it the connection can land on another account this user can reach,
+	// where the poll below — and every later build — cannot see it.
+	const url = new URL(getConsoleIntegrationsUrl(account));
+	url.searchParams.set('localCliCommand', 'connect-git-provider');
+	url.searchParams.set('gitProvider', provider);
+	url.searchParams.set('localCliPort', `${port}`);
+	url.searchParams.set('localCliToken', authToken);
+	url.searchParams.set('localCliApiVersion', API_VERSION);
+	try {
+		url.searchParams.set('localCliComputerName', encodeURIComponent(computerName()));
+	} catch {
+		// Not critical, and it only labels the request in Console.
+	}
+
+	info({ message: `Connect your ${label} account to Apify: ${url.href}` });
+	// Printed above as well — a headless session, or a machine with no usable default browser, still needs it.
+	open(url.href).catch(() => undefined);
+	info({ message: 'Waiting for the connection to complete in your browser...' });
+
+	try {
+		return await finished;
+	} finally {
+		clearTimeout(timer);
+		// `close` alone waits for open sockets, and the browser can leave one behind. This runs at the
+		// start of `apify create`, so a stray handle would hang the command long after its work is done.
+		server.closeAllConnections();
+		server.close();
+	}
+};