---
title: SSH keys
description: Add the public keys Dekka installs on new virtual servers, check their fingerprints, and fix a key Dekka refuses.
section: Servers
order: 2
---

SSH keys belong to your organisation, and Dekka installs the ones you choose for root when it creates a [virtual server](/docs/virtual-servers). Dekka only ever holds the public half, and your private key stays on your machine.

## Add a key

Open **Settings**, then **SSH keys**, and choose **Add SSH key**, or choose **Add a key** while creating a server. Paste one public key on a single line, which is usually the contents of `~/.ssh/id_ed25519.pub`, and choose **Add key**. The **Name** is optional and defaults to the comment at the end of the key.

If you don't have a key yet, make an ed25519 one and print its public half.

```bash
ssh-keygen -t ed25519 -C "you@laptop"
cat ~/.ssh/id_ed25519.pub
```

Developers, admins and owners can add and delete keys, and everyone in the organisation can see them. The API adds a key with `POST /v1/orgs/{org_id}/ssh-keys`, a `name` and the `public_key`.

## Which keys are accepted?

| Type | Notes |
| --- | --- |
| `ssh-ed25519` | The best choice for a new key |
| `ecdsa-sha2-nistp256`, `ecdsa-sha2-nistp384`, `ecdsa-sha2-nistp521` | ECDSA on the NIST curves |
| `ssh-rsa` | At least 2048 bits |

Any other type answers 422 `unsupported_ssh_key_type`.

## Check a fingerprint

Dekka shows each key's SHA-256 fingerprint, which starts with `SHA256:`, in the same form `ssh-keygen` prints, so you can compare it with the key on your machine.

```bash
ssh-keygen -lf ~/.ssh/id_ed25519.pub
```

Each key can be saved once per organisation, and saving it again answers 409 `ssh_key_exists` with the name it's already saved under.

## Why was my key refused?

| Code | What to do |
| --- | --- |
| `private_key_rejected` | You pasted a private key. Paste the public key from the file ending in `.pub` instead, and keep the private key on your machine. |
| `ssh_key_too_weak` | The RSA key has fewer than 2048 bits. Make a new ed25519 key. |
| `unsupported_ssh_key_type` | The key's type isn't in the table above. |
| `invalid_ssh_key` | The text isn't a valid public key, or it spans more than one line. |
| `ssh_key_exists` | The key is already saved, under the name in the message. |

## Delete a key

Choose the bin icon next to the key under **SSH keys**. New servers can no longer use it, but each server keeps the keys it was created with, so deleting a key doesn't remove it from existing servers, and rebuilding a server installs them again. To stop a key signing in to a server, remove its line from `~/.ssh/authorized_keys` on that server.