SupportConsole
llms.txtSign in

Add SSH keys to a server and to your account

llms.txt

SSH keys are how people, and deploy tools, log in to your servers without passwords. SrvYard keeps two lists: a library of public keys saved for your organisation (or just for you), and, on each server, the keys that are actually authorised to log in. Saving a key in the library does nothing to any machine; adding it to a server is a separate, explicit step. That keeps the answer to "who can log in where?" easy to read.

This article covers both lists and the one setting that connects them: adding chosen keys to every server you create from now on.

Before you begin

  • A public key. The contents of a .pub file. If you have none, create one on your computer:
ssh-keygen -t ed25519 -C "[email protected]"
cat ~/.ssh/id_ed25519.pub

SrvYard accepts ed25519, ECDSA and RSA keys (RSA of at least 2048 bits). Never paste the private key (the file without .pub).

  • A ready server to add the key to, and a role that may add keys to servers. Removing keys needs its own permission.
  • For organisation keys, a role that may save keys for the whole organisation. Members without it can still save keys that belong only to them.

1. Read a server's keys

Open the server and choose the SSH keys tab. The page says "Keys that can log in to this server. Removing a key here only removes the line SrvYard added."

The SSH keys tab of a server
Every key that can log in to the server, and the one SrvYard cannot do without.
  1. Add key. Opens the panel for authorising another key (steps 2 and 3).
  2. SrvYard, marked Required. SrvYard's own key, which it uses to manage the server. It can never be removed here. If it is ever removed by accident, the page shows it again in the SrvYard's public key card below, with the instruction to put it back into ~/.ssh/authorized_keys of both root and srvyard from the provider's console.
  3. Status. Authorised when the key is on the machine, Adding or Removing while a change runs and Failed when the server refused it.
  4. Row actions (the three dots) offers Rename and Remove from server.

Each row shows the key's Name, the User it can log in as, a shortened Fingerprint and how long ago it was Added. Below the table, The server's own key is the public key this server uses to pull your repositories; add it as a deploy key at your Git host if SrvYard did not do that for you.

2. Add a saved key to the server

Press Add key. A panel opens with two modes.

The Add SSH key panel, picking a saved key
Choose one of your saved keys and the user it may log in as.
  1. Pick from your keys. Chooses from the library.
  2. Key. The saved key to authorise. You see organisation keys and your own; owners and admins see every member's keys.
  3. Login user. srvyard, the user SrvYard created and which owns your sites, or root. Use srvyard unless you have a reason; it has sudo for administration.
  4. Add key. Disabled until a key is chosen. SrvYard shows "Adding the key to the server..." and the row appears with the status Adding, then Authorised.

3. Paste a new key

When the key is not in the library yet, switch to the second mode.

The Add SSH key panel, pasting a new key
Paste the contents of a .pub file to authorise a key you have not saved yet.
  1. Paste a new key. Switches the panel.
  2. Name. A label for the key, for example the owner and the device. Up to 60 characters.
  3. Public key. The contents of the .pub file: one line starting with ssh-ed25519, ecdsa-sha2-... or ssh-rsa. A key that SrvYard cannot parse is refused with a message under the field.
  4. Save to the organization. Also stores the key in the library so you can reuse it on other servers. It is shown only to members allowed to save organisation keys.
  5. Login user. As above.

SrvYard adds one line to the user's authorized_keys that it can find again later, so removing the key never disturbs other lines you added by hand.

Tip

To log in once the key is authorised, use ssh [email protected] (the server's address from its Overview tab, with your own address in place of the example).

4. Rename or remove a key on a server

The row menu of a key on a server
Rename a key's label or take it off the server.
  1. Rename. Changes the label in SrvYard only. Nothing is written to the machine.
  2. Remove from server. Asks for confirmation ("The key can no longer log in to this server as srvyard. It stays in your saved keys, and other servers are not affected."), then removes SrvYard's line and shows "Removing the key from the server...".

5. Keep a library of keys

The library lives under Settings > Security. The page is titled SSH keys and explains that these are public keys saved for your organisation, to be added to servers from each server's SSH keys tab.

The organisation SSH key library
The library of keys you can add to any server.
  1. Add key. Saves a key to the library.
  2. New servers. A switch on organisation keys. When on, the key is authorised for the srvyard user while a new server is provisioned. Personal keys show a dash: only organisation keys can be added to new servers. Existing servers are not changed.

The table also lists each key's owner (a member's name, or Organization), its Type, fingerprint, On servers (how many servers currently use it) and age. A row's action menu has Delete.

Saving a key to the library
Saving a key to the library does not put it on any server.
  1. Name. Up to 60 characters.
  2. Public key. Contents of your .pub file. ed25519, ECDSA and RSA (2048 bits or more) are accepted.
  3. Belongs to. The organization makes the key visible to everyone who may add keys to servers; Only me keeps it private to you.
  4. Add to all new servers. Authorised for the management user while a server is provisioned. Existing servers are not changed. The create-server form's Add my organization SSH keys switch (in Advanced settings) controls whether a given new server gets them.
Warning

Deleting a key from the library does not remove it from servers it was already added to ("It stays authorised on N servers until you remove it there."). Remove it on each server's SSH keys tab. When a colleague leaves, check the On servers column for their keys and remove them from every server.

Troubleshooting

  • The key was refused as invalid. You pasted a private key, a key with line breaks in the middle, an unsupported type or an RSA key shorter than 2048 bits. Paste the single line from the .pub file.
  • The row stays on "Adding". The server is probably unreachable. Check the Overview tab; the change completes when SrvYard can connect again.
  • The status is Failed. Hover or open the server's activity to see why, fix it, then remove the key and add it again.
  • The key is authorised but ssh still asks for a password. Check you log in as the user you chose, that your client offers that key (ssh -i ~/.ssh/id_ed25519 [email protected]) and that the provider's firewall lets your address reach the SSH port.
  • I cannot see Add key. Your role cannot add keys to this server, or the server is not ready.
  • A colleague's key is not in the list. Personal keys are only visible to their owner and to owners and admins. Ask them to save it to the organisation or paste it directly.
  • New servers do not get my key. The key must be an organisation key with New servers switched on, and Add my organization SSH keys must be on in the new server's advanced settings.
Last updated 2026-10-247 min readNeed help? Contact support
PreviousManage services and restartsNextOpen and close ports with the firewall