Merathon, home page

Git Cheat Sheet · Synchronize

Set up an SSH key

ssh-keygen -t ed25519

An SSH key lets you fetch and push without a token, on repositories whose remote uses SSH (git@host:…). ssh-keygen -t ed25519 creates the key pair: the private key stays on your machine, and only the public key (.pub) is registered on GitHub or GitLab.

By , author of Merathon · published on

What it does

An SSH key replaces the token for repositories whose remote uses SSH (git@host:…). The private key stays on your machine; only the public key is registered on GitHub or GitLab. On first connection, the server fingerprint is checked then stored in ~/.ssh/known_hosts.

A use case

Your repositories are cloned as git@github.com:… and you want fetch and push to also work on the command line, without entering a token.

Warning: Without a passphrase, anyone who copies the private key file can access your repositories. With a passphrase, add the key to your SSH agent (ssh-add): Merathon does not ask for it during fetch and push.

On the command line

ssh-keygen -t ed25519 -C "me@example.com"
Creates the key pair, by default in ~/.ssh/id_ed25519.
ssh-add ~/.ssh/id_ed25519
Adds the key to the SSH agent, so you only type the passphrase once.
gh ssh-key add ~/.ssh/id_ed25519.pub --title "My computer"
GitHub CLI: registers the public key on the account.
ssh -T git@github.com
Tests the connection and shows the account recognized.
git remote set-url origin git@github.com:me/project.git
Moves an existing repository from HTTPS to SSH.

In Merathon

  1. "Accounts" tab: right-click the account → "Set up SSH…".
  2. Choose an existing key, or create ~/.ssh/id_ed25519 if it does not exist. An existing key is never overwritten.
  3. Confirm: the key is registered on the account, then the connection is tested.
  4. If the token cannot add keys (GitHub: write:public_key scope), copy the public key and add it on the suggested page.

Frequently asked questions

What should I do about "Permission denied (publickey)"?

The key presented is not registered on the account, or no key is loaded. ssh -T git@github.com tests the connection, ssh-add -l lists the agent's keys, and ssh -vT git@github.com shows the keys tried.

Which key do I share?

Only the .pub file. The file without an extension is the private key: it must never leave your machine.

Do I need a passphrase?

It is better: without one, anyone who copies the private key file can access your repositories. With a passphrase, add the key to your SSH agent with ssh-add.

Do my HTTPS repositories move to SSH by themselves?

No. Each repository's remote stays as it is until a git remote set-url. Merathon does not change it either: these repositories keep using the token.

See also