# SSH keys

Add an SSH key to push and pull over SSH, to sign commits, or both. Open
**Settings → SSH Keys**.

## Add an SSH key

1. Choose **Add SSH key**.
2. Enter a **Title** to recognise the key.
3. Choose the **Key type**:
   - **Authentication**: use the key for Git over SSH.
   - **Signing**: use the key to sign commits and tags. Requires an Ed25519
     key.
   - **Authentication & Signing**: both.
4. Paste your public key, the contents of your `.pub` file. Supported types are
   `ssh-ed25519`, `ssh-rsa`, `ecdsa-sha2-nistp256/384/521` and their `sk-`
   security-key variants.
5. For authentication keys, choose under **Access** what the key may do, using
   the same permissions as [personal access tokens](https://staging.git.cafe/docs/account/personal-access-tokens.md#custom-permissions).
6. Choose **Add key**.

A key can be registered to only one account. To change an existing key's type
or access, delete it and add it again.

From the terminal, `cafe auth ssh setup` finds your key, registers it and can
configure Git to sign with it. `cafe auth ssh add ~/.ssh/id_ed25519.pub` adds a
key directly.

## Use your key with Git

Copy the SSH address from the repository's **Code → SSH** tab, such as
`git.cafe:owner/repo`, and clone with it:

```sh
git clone git.cafe:owner/repo
```

See [Git access](https://staging.git.cafe/docs/getting-started/git-access.md#use-ssh). SSH connections
only serve Git; there is no shell, port forwarding or SFTP.

## Sign commits with your key

Add the key with **Signing** usage, then configure Git:

```sh
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
```

`cafe auth ssh setup --configure-git-signing --sign-commits` does the same.

## Remove an SSH key

Choose the bin icon on the key and confirm with **Delete**. Its access is
revoked at the same time.