Have a groovy script that's executed by the Jenkins Worflow Plugin.
As documented, the git step has only basic configuration so far, having only a single url parameter, and it's suggested to use the general checkout scm step for anything more complex.
With this, it's possible to pass credentialsId as so:
checkout scm: [$class: 'MercurialSCM', source: 'ssh://hg@bitbucket.org/user/repo', clean: true, credentialsId: '1234-5678-abcd']
But how would one get this to work with an SSH key credentials instead?