# SSH keys

Open **Settings → SSH Keys** while signed in to add a key for Git authentication
or commit signing.

Git over SSH is available when the deployment enables its SSH listener. Use
the SSH address supplied by the forge. Authentication keys can access only the repositories and operations you permit. Signing-only keys cannot
authenticate. An SSH connection does not provide a shell, forwarding or SFTP.

## View your keys

Each key shows its title, `SHA256:` fingerprint (as `ssh-keygen -lf` prints
it), algorithm badge (`ed25519`, `rsa`, ...), usage badge and the date it was
added. Newest first.

## Add a key

**Add SSH key** opens a form:

- **Title**: a label for your own reference.
- **Key type**: **Authentication** (Git over SSH), **Signing** (verifies
  commits and tags) or **Authentication & Signing**. Signing requires an
  Ed25519 key; other algorithms are refused with "Only Ed25519 keys are
  supported for commit signing."
- **Public key**: the contents of your `.pub` file. Accepted algorithms are
  `ssh-ed25519`, `ssh-rsa`, `ecdsa-sha2-nistp256/384/521` and the
  `sk-` security-key variants.
- **Access** (authentication keys only): the same grant editor as personal
  access tokens. The key is bound to a grant carrying exactly these
  permissions; **Add key** stays disabled until at least one grant is chosen.
  Signing-only keys carry no grant.

A fingerprint already registered to another account is refused. Re-adding your
own key with the same access returns the existing key; asking for
authentication on a signing-only key, or for different access, is refused
with a message to delete and re-add it.

## Remove a key

The bin icon opens **Delete SSH key**; confirm with **Delete**. The bound grant
is revoked with the key.