How to Use SSH Keys for GitHub Authentication

Quick Answer: To use SSH keys for GitHub authentication, generate a modern Ed25519 key pair with ssh-keygen -t ed25519 -C "your_email@example.com", start the SSH agent with eval "$(ssh-agent -s)", add your private key using ssh-add ~/.ssh/id_ed25519, and copy the contents of ~/.ssh/id_ed25519.pub into your GitHub account under Settings > SSH and GPG keys. Verify your connection with ssh -T git@github.com.

In modern software development, securing access to source code repositories is paramount. With GitHub hosting hundreds of millions of repositories, relying on basic password authentication is both obsolete and insecure—in fact, GitHub deprecated password authentication for Git operations in 2021. Today, SSH (Secure Shell) key authentication is the industry standard for fast, encrypted, and passwordless Git interactions across local development workstations, CI/CD pipelines, and cloud environments.

This comprehensive guide walks you through the complete lifecycle of SSH key management for GitHub—from cryptographic generation and SSH agent configuration to advanced multi-account setups and troubleshooting common connection failures.

-

1. Key Concepts Explained: How SSH Authentication Works

SSH authentication relies on asymmetric public-key cryptography. Instead of sending a static password over the wire, authentication is proven through a mathematically paired set of cryptographic keys:

• Private Key (`id_ed25519`): Stored securely on your local computer with strict file permissions. It must never be shared, checked into version control, or uploaded to any server.
• Public Key (`id_ed25519.pub`): Placed in your GitHub account. Anyone can see this key without compromising your security.

When you execute git push or git pull, your local SSH client and GitHub perform a challenge-response handshake:

1. Your SSH client contacts git@github.com on port 22.
2. GitHub sends a random cryptographic challenge encrypted with your public key.
3. Your local client decrypts the challenge using your private key and returns the proof.
4. GitHub verifies the signature and grants access to your repositories without your private key ever traversing the network.

💡 Pro Tip

Pro Tip: Always choose Ed25519 over RSA. Ed25519 keys are faster, more compact, and resistant to side-channel timing attacks.

-

1. Generating Your SSH Key Pair

Follow these steps in your terminal (macOS Terminal, Linux Shell, or Windows Git Bash / WSL2).

Step 1: Open Terminal & Run Keygen

Run the following command, replacing the email with the primary email associated with your GitHub account:

ssh-keygen -t ed25519 -C "your_email@example.com"

If you are using a legacy server or enterprise system that does not support Ed25519, fall back to RSA 4096:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Step 2: Choose File Location & Passphrase

The prompt will ask where to save the key:

Enter a file in which to save the key (/Users/username/.ssh/id_ed25519): [Press Enter]
Enter passphrase (empty for no passphrase): [Enter a secure passphrase]
Enter same passphrase again: [Repeat passphrase]

⚠️ Warning

Warning: While leaving the passphrase empty allows prompt-free pushes, setting a strong passphrase adds crucial encryption at rest. If someone steals your laptop, they cannot use your SSH key without the passphrase.

-

1. Adding Your SSH Key to the SSH Agent

The SSH Agent securely holds your decrypted private keys in memory so you only need to type your passphrase once per login session.

Step 1: Start the SSH Agent

eval "$(ssh-agent -s)"

Step 2: Configure SSH Config File

Create or edit ~/.ssh/config to ensure the agent automatically loads your keys upon startup.

nano ~/.ssh/config

Add the following configuration:

Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519
  AddKeysToAgent yes
  IdentitiesOnly yes

(On macOS Monterey and newer, also add `UseKeychain yes` under the Host block).

Step 3: Add the Private Key to the Agent

ssh-add ~/.ssh/id_ed25519

-

1. Registering Your Public Key on GitHub

Step 1: Copy Your Public Key

Display and copy the exact content of your public key (`.pub`):

macOS:

pbcopy < ~/.ssh/id_ed25519.pub

Linux (with xclip):

xclip -selection clipboard < ~/.ssh/id_ed25519.pub

Windows (PowerShell / Git Bash):

clip < ~/.ssh/id_ed25519.pub

(Or view the file with `cat ~/.ssh/id_ed25519.pub` and copy the complete text starting with `ssh-ed25519 AAAA...`).

Step 2: Add to GitHub Account

1. Log into your account on GitHub↗.
2. Click your profile picture in the top-right corner and select Settings.
3. In the left navigation sidebar, click SSH and GPG keys.
4. Click the green New SSH key button.
5. In the Title field, enter a descriptive label (e.g., Work-MacBook-Pro-2026).
6. Set Key type to Authentication Key.
7. Paste your key into the Key field.
8. Click Add SSH key and confirm with your GitHub password or passkey.

-

1. Testing and Verifying Your SSH Connection

To verify that your authentication is working properly, run:

ssh -T git@github.com

If this is your first time connecting to GitHub via SSH, you will see a fingerprint authenticity prompt:

The authenticity of host 'github.com (140.82.121.4)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes and hit Enter. If successful, GitHub responds with:

Hi username! You've successfully authenticated, but GitHub does not provide shell access.

📌 Note

Note: Shell access is intentionally disabled on GitHub; receiving this message confirms authentication succeeded 100%.

Switching Existing Repositories from HTTPS to SSH

If your local repositories were cloned via HTTPS, switch them to SSH using:

git remote set-url origin git@github.com:username/repository-name.git

Verify the remote URL with git remote -v.

-

1. Common Mistakes to Avoid

-

1. Advanced Strategies: Managing Multiple GitHub Accounts

Developers working with separate personal and corporate GitHub accounts can manage distinct SSH identities seamlessly via ~/.ssh/config.

Step 1: Generate Separate Key Pairs

ssh-keygen -t ed25519 -C "personal@email.com" -f ~/.ssh/id_ed25519_personal
ssh-keygen -t ed25519 -C "work@company.com" -f ~/.ssh/id_ed25519_work

Step 2: Configure SSH Host Aliases

Edit ~/.ssh/config:

 Personal GitHub Account
Host github.com-personal
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_personal
  IdentitiesOnly yes

 Work GitHub Account
Host github.com-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work
  IdentitiesOnly yes

Step 3: Clone Using the Host Alias

When cloning personal or work repositories, replace github.com in the git URL with your alias:

 For Personal Repo
git clone git@github.com-personal:personal-username/my-project.git

 For Work Repo
git clone git@github.com-work:company-org/enterprise-app.git

-

1. Real-World Best Practices & Key Rotation

1. Audit Keys Annually: Periodically review the keys listed in GitHub Settings > SSH and GPG keys. Delete keys from old laptops or decommissioned workstations immediately.
2. Use Hardware Security Keys (FIDO2/YubiKey): Modern OpenSSH supports hardware-backed SSH keys using ssh-keygen -t ed25519-sk. This ensures the private key cannot be exported or stolen via malware.
3. Repository Deploy Keys: For CI/CD servers (GitHub Actions, Jenkins, Docker), use Deploy Keys with read-only permissions scoped to specific repositories rather than granting access to your full user account.
4. Git Commit Signing: In addition to authentication, you can use your SSH key to cryptographically sign Git commits (git config global gpg.format ssh), displaying the Verified badge on GitHub.

-

Related NomaWorld Guides & In-Depth Reading

• Read our in-depth guide: How to Master Effective Note Taking Methods
• Read our in-depth guide: How to Write a Professional Business Plan
• Read our in-depth guide: How to Invest in the Stock Market for Beginners
• From NOMAWorld Weekly Magazine: Global Economic Shifts and Market Volatility

Verified Academic & Technology Authority Platforms

• KingPin AI & Tech: Explore specialized tools on kingpin.co.ke↗ — Technology and AI ecosystem connecting writing, originality, humanization, research, SEO, and automation products.
• HumaraGPT: Explore specialized tools on humaragpt.com↗ — AI writing and humanization platform for natural text and style refinement.
• Ozone3 Writing Suite: Explore specialized tools on ozone3.site↗ — AI-powered writing and editing environment for technical drafting and readability.

-

Frequently Asked Questions

What is the difference between SSH and HTTPS authentication on GitHub? HTTPS authentication uses Personal Access Tokens (PATs) that expire and require token management. SSH authentication uses asymmetric cryptographic keys stored on your computer, providing a permanent, secure, and passwordless experience without exposing credentials.

How do I check if I already have existing SSH keys? Run ls -al ~/.ssh in your terminal. Look for files named id_ed25519.pub, id_rsa.pub, or id_ecdsa.pub. If they exist, you can use them or create a new dedicated key pair.

Is Ed25519 safer than RSA for GitHub? Yes. Ed25519 uses the Edwards-curve Digital Signature Algorithm (EdDSA), offering superior cryptographic strength with a much shorter 256-bit key size, faster signature computation, and immunity to side-channel cache attacks.

Why do I get "Permission denied (publickey)" when pushing code? This error means GitHub was unable to authenticate your client. It typically occurs if your public key was not added to your GitHub account, your SSH agent is not running, or your local repository is trying to use an unconfigured key.

Can I use the same SSH key on multiple computers? While technically possible by copying the key file, it is considered a bad security practice. Instead, generate a unique key pair on each computer (e.g. home desktop, work laptop) and add each public key separately to your GitHub account.