SSH keys#

Open Settings → SSH Keys while signed in to add a key for Git authentication or commit signing.

Git over SSH is available when the deployment enables its SSH listener. Use Code → SSH on the repository to copy its SSH address, such as git.cafe:owner/repo. The empty-repository setup panel also offers HTTPS and SSH; selecting a protocol updates both clone and existing-repository commands. Clone addresses omit the optional .git suffix. SSH authenticates your key, so a username in the address is optional. Authentication keys can access only the repositories and operations you permit. Signing-only keys cannot authenticate. An SSH connection does not provide a shell, forwarding or SFTP.

View your keys#

Each key shows its title, SHA256: fingerprint (as ssh-keygen -lf prints it), algorithm badge (ed25519, rsa, ...), usage badge and the date it was added. Newest first.

Add a key#

Add SSH key opens a form:

• Title: a label for your own reference.
• Key type: Authentication (Git over SSH), Signing (verifies commits and tags) or Authentication & Signing. Signing requires an Ed25519 key; other algorithms are refused with "Only Ed25519 keys are supported for commit signing."
• Public key: the contents of your .pub file. Accepted algorithms are ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521 and the sk- security-key variants.
• Access (authentication keys only): the same grant editor as personal access tokens. The key is bound to a grant carrying exactly these permissions; Add key stays disabled until at least one grant is chosen. Signing-only keys carry no grant.

A fingerprint already registered to another account is refused. Re-adding your own key with the same access returns the existing key; asking for authentication on a signing-only key, or for different access, is refused with a message to delete and re-add it.

Remove a key#

The bin icon opens Delete SSH key; confirm with Delete. The bound grant is revoked with the key.