Guides
SSH Keys
Personal keys, org keys, and guest keys — which to use, how to rotate, and what never to share.
Three key scopes
- Personal (
/settings/ssh-keys) — yours only. Applied at instance create. - Organization (
/organization/ssh-keys, needssshkeys:manage) — shared to workspace members. - Guest (per-VM) — temporary access on one instance. List or revoke from instance settings.
Keys inject via cloud-init at create. Adding a key later does not retro-apply — use Apply keys on the instance to push selected personal/org keys.
Add a key
- Paste public key only (
ssh-ed25519 ...orssh-rsa ...). - Name it so you can revoke later (
laptop-2026, notkey1). - Create instance with that key selected, or apply to running instance.
Connect with matching private key:
ssh <username>@<instance-ip>Rotate and revoke
- Lost laptop? Delete personal key + revoke guest keys on each active instance.
- Teammate left? Org admin removes org key. It blocks future launches, not past sessions — rotate instance credentials too.
- Never send private keys or passwords to Support. Public key + username + instance ID is enough.
Stuck at SSH refused? Recheck username, address, and which public key was selected at create. Then see Troubleshooting.