Architecture<\/h2>\n\n\n\n\n- When you use an SSH remote, Git connects to GitHub as the user
git<\/code> and offers a public key from your machine’s ~\/.ssh<\/code> folder<\/li>\n\n\n\n- GitHub compares that key against the public keys saved on your account<\/li>\n\n\n\n
- If one matches, you’re authenticated. If none match, or no key is offered at all, GitHub refuses the connection<\/li>\n<\/ul>\n\n\n\n
The diagram below shows where the permission denied publickey error comes from:<\/p>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/SSH-Key-Authentication-Flow-Diagram-1024x683.png\")
<\/a><\/figure>\n\n\n\nFor the full background, see GitHub’s guide to connecting with SSH<\/a>.<\/p>\n\n\n\nSteps to Fix the Permission Denied Publickey Error<\/h2>\n\n\n\n1. Check the Connection<\/h3>\n\n\n\n
Test the SSH connection to GitHub:<\/p>\n\n\n\n
ssh -T git@github.com\n<\/pre>\n\n\n\nIf your key isn’t recognized, you’ll see the permission denied publickey error:<\/p>\n\n\n\n
git@github.com: Permission denied (publickey).\n<\/pre>\n\n\n\nFor more detail, add the -v<\/code> option:<\/p>\n\n\n\nssh -vT git@github.com\n<\/pre>\n\n\n\nLook for lines such as no such identity: \/home\/user\/.ssh\/id_rsa<\/code>. They tell you no key exists at the default location.<\/p>\n\n\n\n\nOn your first connection, SSH asks you to confirm GitHub’s host fingerprint. Only accept it if it matches one of GitHub’s published fingerprints<\/a>.<\/p>\n<\/blockquote>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/Screenshot-from-2019-04-03-19-02-09-1024x555-1.png\")
<\/a><\/figure>\n\n\n\n2. Check for Existing Keys<\/h3>\n\n\n\nls -al ~\/.ssh\n<\/pre>\n\n\n\nLook for a key pair such as id_ed25519<\/code> and id_ed25519.pub<\/code>, or the older id_rsa<\/code> and id_rsa.pub<\/code>. If you already have a pair, skip to Step 4.<\/p>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/Screenshot-from-2019-04-04-14-24-54-1.png\")
<\/a><\/figure>\n\n\n\n3. Generate a New SSH Key<\/h3>\n\n\n\nssh-keygen -t ed25519 -C \"your_email@example.com\"\n<\/pre>\n\n\n\nAccept the default location and set a passphrase when asked.<\/p>\n\n\n\n
\nNotes:<\/strong><\/p>\n\n\n\n\n- The original guide used the older RSA key type. RSA still works, but ed25519 is the current recommendation. If your system is too old to support ed25519, use
ssh-keygen -t rsa -b 4096 -C \"your_email@example.com\"<\/code> instead.<\/li>\n\n\n\n- The original also advised using
sudo<\/code> when generating keys. Don’t. Keys created with sudo<\/code> land in root’s ~\/.ssh<\/code>, and a normal git<\/code> command won’t use them. In the same way, sudo git ...<\/code> uses root’s keys, not yours. Run ssh-keygen<\/code> and git<\/code> as the same user, without sudo<\/code>.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n4. Add the Key to ssh-agent<\/h3>\n\n\n\neval \"$(ssh-agent -s)\"\nssh-add ~\/.ssh\/id_ed25519\n<\/pre>\n\n\n\n5. Add the Public Key to GitHub<\/h3>\n\n\n\n
Print your public key and copy the whole line exactly as shown, with no extra spaces or characters:<\/p>\n\n\n\n
cat ~\/.ssh\/id_ed25519.pub\n<\/pre>\n\n\n\nThen, on GitHub:<\/p>\n\n\n\n
\n- Click your profile photo and open Settings<\/strong><\/li>\n\n\n\n
- Select SSH and GPG keys<\/strong><\/li>\n\n\n\n
- Click New SSH key<\/strong><\/li>\n\n\n\n
- Enter a title, paste the key, and click Add SSH key<\/strong><\/li>\n<\/ol>\n\n\n\n
\nSecurity note:<\/strong> Only ever paste the public<\/strong> key (the file ending in .pub<\/code>). Never share or paste your private key, which is the file with the same name and no extension.<\/p>\n<\/blockquote>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/Screenshot-from-2019-04-04-14-16-13-2.png\")
<\/a><\/figure>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/Screenshot-from-2019-04-03-19-05-50-1024x562-1.png\")
<\/a><\/figure>\n\n\n\n6. Test the Connection<\/h3>\n\n\n\nssh -T git@github.com\n<\/pre>\n\n\n\nA successful result means the permission denied publickey error is gone:<\/p>\n\n\n\n
Hi username! You've successfully authenticated, but GitHub does not provide shell access.\n<\/pre>\n\n\n\nStill Seeing Permission Denied Publickey?<\/h2>\n\n\n\n
If the permission denied publickey error continues after the steps above, check these common causes:<\/p>\n\n\n\n
\n- Wrong URL format.<\/strong> SSH remotes must use
git@github.com<\/code>, not your own username, for example git@github.com:user\/repo.git<\/code>. Check with git remote -v<\/code>, and fix it with: git remote set-url origin git@github.com:user\/repo.git<\/code><\/li>\n\n\n\n- Key not loaded.<\/strong> Run
ssh-add -l<\/code> to see which keys the agent holds. If it’s empty, repeat Step 4.<\/li>\n\n\n\n- Wrong file permissions.<\/strong> SSH ignores keys that are too open:
chmod 700 ~\/.sshchmod 600 ~\/.ssh\/id_ed25519<\/code><\/li>\n\n\n\n- Key on the wrong account.<\/strong> Make sure the key was added to the GitHub account that owns the repository. If your organization uses SAML SSO, you may also need to authorize the key for that organization.<\/li>\n\n\n\n
- Several keys on one machine.<\/strong> Tell SSH exactly which one to use in
~\/.ssh\/config<\/code>: Host github.com HostName github.com User git IdentityFile ~\/.ssh\/id_ed25519 IdentitiesOnly yes<\/code><\/li>\n<\/ul>\n\n\n\nConclusion<\/h2>\n\n\n\n
The permission denied publickey error comes down to GitHub not finding a matching key. Create a key pair if you don’t have one, load it into ssh-agent<\/code>, add the public half to your GitHub account, and test with ssh -T git@github.com<\/code>. If it still fails, check the remote URL, file permissions, and that you aren’t mixing keys between sudo<\/code> and your normal user.<\/p>\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
Why do I get permission denied publickey even though I added my key?<\/strong> The most common reasons are that the key isn’t loaded in ssh-agent<\/code>, Git is running as a different user (for example with sudo<\/code>), or the key was added to a different GitHub account than the one that owns the repository.<\/p>\n\n\n\nDoes the permission denied publickey error also happen with GitLab or Bitbucket?<\/strong> Yes. It’s an SSH message, not a GitHub-specific one. The same steps apply. Add the public key in your GitLab or Bitbucket account settings, and test against that host.<\/p>\n\n\n\nCan I use HTTPS instead of SSH?<\/strong> Yes. Note that GitHub no longer accepts your account password for Git over HTTPS, so you’d use a personal access token instead.<\/p>\n\n\n\nShould I set a passphrase on my SSH key?<\/strong> Yes. A passphrase protects the key if the file is ever copied. ssh-agent<\/code> means you only type it once per session.<\/p>\n\n\n\nRelated Articles<\/h2>\n\n\n\n
How to use SSH Key with passpharse for SSH forwarding<\/a><\/p>\n\n\n\n
git<\/code> and offers a public key from your machine’s ~\/.ssh<\/code> folder<\/li>\n\n\n\n- GitHub compares that key against the public keys saved on your account<\/li>\n\n\n\n
- If one matches, you’re authenticated. If none match, or no key is offered at all, GitHub refuses the connection<\/li>\n<\/ul>\n\n\n\n
The diagram below shows where the permission denied publickey error comes from:<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\nFor the full background, see GitHub’s guide to connecting with SSH<\/a>.<\/p>\n\n\n\nSteps to Fix the Permission Denied Publickey Error<\/h2>\n\n\n\n1. Check the Connection<\/h3>\n\n\n\n
Test the SSH connection to GitHub:<\/p>\n\n\n\n
ssh -T git@github.com\n<\/pre>\n\n\n\nIf your key isn’t recognized, you’ll see the permission denied publickey error:<\/p>\n\n\n\n
git@github.com: Permission denied (publickey).\n<\/pre>\n\n\n\nFor more detail, add the -v<\/code> option:<\/p>\n\n\n\nssh -vT git@github.com\n<\/pre>\n\n\n\nLook for lines such as no such identity: \/home\/user\/.ssh\/id_rsa<\/code>. They tell you no key exists at the default location.<\/p>\n\n\n\n\nOn your first connection, SSH asks you to confirm GitHub’s host fingerprint. Only accept it if it matches one of GitHub’s published fingerprints<\/a>.<\/p>\n<\/blockquote>\n\n\n\n<\/a><\/figure>\n\n\n\n2. Check for Existing Keys<\/h3>\n\n\n\nls -al ~\/.ssh\n<\/pre>\n\n\n\nLook for a key pair such as id_ed25519<\/code> and id_ed25519.pub<\/code>, or the older id_rsa<\/code> and id_rsa.pub<\/code>. If you already have a pair, skip to Step 4.<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\n3. Generate a New SSH Key<\/h3>\n\n\n\nssh-keygen -t ed25519 -C \"your_email@example.com\"\n<\/pre>\n\n\n\nAccept the default location and set a passphrase when asked.<\/p>\n\n\n\n
\nNotes:<\/strong><\/p>\n\n\n\n\n- The original guide used the older RSA key type. RSA still works, but ed25519 is the current recommendation. If your system is too old to support ed25519, use
ssh-keygen -t rsa -b 4096 -C \"your_email@example.com\"<\/code> instead.<\/li>\n\n\n\n- The original also advised using
sudo<\/code> when generating keys. Don’t. Keys created with sudo<\/code> land in root’s ~\/.ssh<\/code>, and a normal git<\/code> command won’t use them. In the same way, sudo git ...<\/code> uses root’s keys, not yours. Run ssh-keygen<\/code> and git<\/code> as the same user, without sudo<\/code>.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n4. Add the Key to ssh-agent<\/h3>\n\n\n\neval \"$(ssh-agent -s)\"\nssh-add ~\/.ssh\/id_ed25519\n<\/pre>\n\n\n\n5. Add the Public Key to GitHub<\/h3>\n\n\n\n
Print your public key and copy the whole line exactly as shown, with no extra spaces or characters:<\/p>\n\n\n\n
cat ~\/.ssh\/id_ed25519.pub\n<\/pre>\n\n\n\nThen, on GitHub:<\/p>\n\n\n\n
\n- Click your profile photo and open Settings<\/strong><\/li>\n\n\n\n
- Select SSH and GPG keys<\/strong><\/li>\n\n\n\n
- Click New SSH key<\/strong><\/li>\n\n\n\n
- Enter a title, paste the key, and click Add SSH key<\/strong><\/li>\n<\/ol>\n\n\n\n
\nSecurity note:<\/strong> Only ever paste the public<\/strong> key (the file ending in .pub<\/code>). Never share or paste your private key, which is the file with the same name and no extension.<\/p>\n<\/blockquote>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n6. Test the Connection<\/h3>\n\n\n\nssh -T git@github.com\n<\/pre>\n\n\n\nA successful result means the permission denied publickey error is gone:<\/p>\n\n\n\n
Hi username! You've successfully authenticated, but GitHub does not provide shell access.\n<\/pre>\n\n\n\nStill Seeing Permission Denied Publickey?<\/h2>\n\n\n\n
If the permission denied publickey error continues after the steps above, check these common causes:<\/p>\n\n\n\n
\n- Wrong URL format.<\/strong> SSH remotes must use
git@github.com<\/code>, not your own username, for example git@github.com:user\/repo.git<\/code>. Check with git remote -v<\/code>, and fix it with: git remote set-url origin git@github.com:user\/repo.git<\/code><\/li>\n\n\n\n- Key not loaded.<\/strong> Run
ssh-add -l<\/code> to see which keys the agent holds. If it’s empty, repeat Step 4.<\/li>\n\n\n\n- Wrong file permissions.<\/strong> SSH ignores keys that are too open:
chmod 700 ~\/.sshchmod 600 ~\/.ssh\/id_ed25519<\/code><\/li>\n\n\n\n- Key on the wrong account.<\/strong> Make sure the key was added to the GitHub account that owns the repository. If your organization uses SAML SSO, you may also need to authorize the key for that organization.<\/li>\n\n\n\n
- Several keys on one machine.<\/strong> Tell SSH exactly which one to use in
~\/.ssh\/config<\/code>: Host github.com HostName github.com User git IdentityFile ~\/.ssh\/id_ed25519 IdentitiesOnly yes<\/code><\/li>\n<\/ul>\n\n\n\nConclusion<\/h2>\n\n\n\n
The permission denied publickey error comes down to GitHub not finding a matching key. Create a key pair if you don’t have one, load it into ssh-agent<\/code>, add the public half to your GitHub account, and test with ssh -T git@github.com<\/code>. If it still fails, check the remote URL, file permissions, and that you aren’t mixing keys between sudo<\/code> and your normal user.<\/p>\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
Why do I get permission denied publickey even though I added my key?<\/strong> The most common reasons are that the key isn’t loaded in ssh-agent<\/code>, Git is running as a different user (for example with sudo<\/code>), or the key was added to a different GitHub account than the one that owns the repository.<\/p>\n\n\n\nDoes the permission denied publickey error also happen with GitLab or Bitbucket?<\/strong> Yes. It’s an SSH message, not a GitHub-specific one. The same steps apply. Add the public key in your GitLab or Bitbucket account settings, and test against that host.<\/p>\n\n\n\nCan I use HTTPS instead of SSH?<\/strong> Yes. Note that GitHub no longer accepts your account password for Git over HTTPS, so you’d use a personal access token instead.<\/p>\n\n\n\nShould I set a passphrase on my SSH key?<\/strong> Yes. A passphrase protects the key if the file is ever copied. ssh-agent<\/code> means you only type it once per session.<\/p>\n\n\n\nRelated Articles<\/h2>\n\n\n\n
How to use SSH Key with passpharse for SSH forwarding<\/a><\/p>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/04\/SSH-Key-Authentication-Flow-Diagram.png\")
<\/a><\/figure>\n\n\n\n