SSH keys

SSH keys belong to your organisation, and Dekka installs the ones you choose for root when it creates a virtual server. Dekka only ever holds the public half, and your private key stays on your machine.

Add a key

Open Settings, then SSH keys, and choose Add SSH key, or choose Add a key while creating a server. Paste one public key on a single line, which is usually the contents of ~/.ssh/id_ed25519.pub, and choose Add key. The Name is optional and defaults to the comment at the end of the key.

If you don't have a key yet, make an ed25519 one and print its public half.

ssh-keygen -t ed25519 -C "you@laptop"
cat ~/.ssh/id_ed25519.pub

Developers, admins and owners can add and delete keys, and everyone in the organisation can see them. The API adds a key with POST /v1/orgs/{org_id}/ssh-keys, a name and the public_key.

Which keys are accepted?

Type	Notes
ssh-ed25519	The best choice for a new key
ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521	ECDSA on the NIST curves
ssh-rsa	At least 2048 bits

Any other type answers 422 unsupported_ssh_key_type.

Check a fingerprint

Dekka shows each key's SHA-256 fingerprint, which starts with SHA256:, in the same form ssh-keygen prints, so you can compare it with the key on your machine.

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Each key can be saved once per organisation, and saving it again answers 409 ssh_key_exists with the name it's already saved under.

Why was my key refused?

Code	What to do
private_key_rejected	You pasted a private key. Paste the public key from the file ending in .pub instead, and keep the private key on your machine.
ssh_key_too_weak	The RSA key has fewer than 2048 bits. Make a new ed25519 key.
unsupported_ssh_key_type	The key's type isn't in the table above.
invalid_ssh_key	The text isn't a valid public key, or it spans more than one line.
ssh_key_exists	The key is already saved, under the name in the message.

Delete a key

Choose the bin icon next to the key under SSH keys. New servers can no longer use it, but each server keeps the keys it was created with, so deleting a key doesn't remove it from existing servers, and rebuilding a server installs them again. To stop a key signing in to a server, remove its line from ~/.ssh/authorized_keys on that server.