> ## Documentation Index
> Fetch the complete documentation index at: https://help.onetsolutions.net/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH Keys

> Add SSH keys to the console for secure, password-free access to your instances

An SSH key pair replaces the password when you connect to an instance. The private half stays on your machine and never leaves it; the public half goes on the server. Keys registered in the console can be installed on an instance when you create or reinstall it, so a new server is reachable without a password from the first boot.

<Info>
  **Prerequisites**

  * An OnetSolutions account with a project
  * An SSH key pair on your machine, or the commands below to create one
</Info>

## Generating a Key Pair

If you do not already have one, generate it locally. Ed25519 is the current recommendation — shorter than RSA and faster, with no loss of security.

```bash theme={null}
# Generate an Ed25519 key pair
ssh-keygen -t ed25519 -C "your.email@example.com"
```

Accept the default path, and set a passphrase when prompted. The passphrase protects the private key if your machine is lost — it does not have to be typed on every connection if you use an agent.

This writes two files:

| File                    | Role                                                       |
| ----------------------- | ---------------------------------------------------------- |
| `~/.ssh/id_ed25519`     | **Private key.** Never share it, never upload it anywhere  |
| `~/.ssh/id_ed25519.pub` | **Public key.** This is the one you paste into the console |

Display the public half to copy it:

```bash theme={null}
cat ~/.ssh/id_ed25519.pub
```

The output is a single line beginning with `ssh-ed25519` and ending with the comment you passed. Copy the whole line.

<Warning>
  Only ever paste the file ending in `.pub`. A private key starts with `-----BEGIN OPENSSH PRIVATE KEY-----`; if you see that, you have the wrong file. A private key that leaves your machine must be considered compromised and replaced.
</Warning>

## Adding a Key to the Console

<Steps>
  <Step title="Open SSH Keys">
    In the console, go to **Compute** and open the **SSH Keys** tab.
  </Step>

  <Step title="Start adding a key">
    Click **Add SSH Key**.
  </Step>

  <Step title="Name the key">
    Fill in **Key Name** with something identifying the machine it belongs to, such as `my-laptop`. This name is only a label for you.
  </Step>

  <Step title="Paste the public key">
    Paste the full contents of your `.pub` file into **Public Key**.
  </Step>

  <Step title="Save">
    Confirm. The key appears in the list with its fingerprint, type, and the date it was added.
  </Step>
</Steps>

<Note>
  SSH keys belong to a project. A key added to one project is not available in another — add it again where you need it.
</Note>

## Using a Key on an Instance

A registered key can be selected when you [create an instance](/vps/getting-started-with-your-vps) or when you reinstall one. The key is installed for the default administrative account, and you can connect immediately:

```bash theme={null}
# Replace with your instance's IP address
ssh root@203.0.113.10
```

If your key is not at the default path, point to it explicitly:

```bash theme={null}
ssh -i ~/.ssh/my_other_key root@203.0.113.10
```

<Warning>
  Adding a key to the console does not install it on instances that already exist. For a running instance, append the public key to `~/.ssh/authorized_keys` on the server, or select the key when you reinstall.
</Warning>

To add a key to a running server yourself:

```bash theme={null}
# From your machine, using an existing access method
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@203.0.113.10
```

## Removing a Key

Deleting a key from the console removes it from the list used for new instances and reinstalls. It does **not** remove it from servers where it was already installed — for that, edit `~/.ssh/authorized_keys` on each instance concerned.

```bash theme={null}
# On the instance, review which keys are trusted
cat ~/.ssh/authorized_keys
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Permission denied (publickey)">
    The server has no matching public key. Confirm the key was selected when the instance was created, and that you are connecting as the right user. Add `-v` to the ssh command to see which keys your client actually offered.
  </Accordion>

  <Accordion title="The console rejects the key">
    The pasted content is not a valid public key. It must be one line starting with `ssh-ed25519`, `ssh-rsa`, or a similar type. Line breaks introduced by a text editor are a common cause.
  </Accordion>

  <Accordion title="Bad permissions on the private key">
    SSH refuses a private key readable by others. Fix it with `chmod 600 ~/.ssh/id_ed25519` and `chmod 700 ~/.ssh`.
  </Accordion>

  <Accordion title="You are asked for the passphrase on every connection">
    That is the agent's job. Run `ssh-add ~/.ssh/id_ed25519` once per session; on macOS, `ssh-add --apple-use-keychain` makes it persist.
  </Accordion>

  <Accordion title="You lost the private key">
    It cannot be recovered — that is the point of it. Generate a new pair, add the new public key, and install it through a [KVM console](/vps/kvm-console) session or a reinstall.
  </Accordion>
</AccordionGroup>

<Tip>
  Once key access works, disable password authentication on the server. It removes brute-force attempts against SSH entirely, which is most of the noise in a server's auth log.
</Tip>