> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/connection-methods/sftp/ssh-key-authentication.md).

# SSH Key Authentication

SSH keys authenticate SFTP sessions in place of passwords. They let automated processes connect without storing an ExaVault password.

## Why Use SSH Keys?

Many organizations rely on automated scripts to handle file transfers over SFTP. When scripts use password-based authentication, the password has to live somewhere the script can read it, which creates a risk of exposure through plain-text files, shared storage, or version control.

SSH key authentication lets the connecting system keep a private key while ExaVault stores only the corresponding public key. Protect the private key as carefully as a password.

## Add SSH Key Authentication

First [create or obtain](#creating-ssh-keys) a key pair. Then [upload the public key](#uploading-your-key) to the `.ssh` directory in the ExaVault home folder and configure the SFTP client to [use the private key](#using-your-key).

### Creating SSH Keys

The exact steps for creating a key depend on your environment. See the appropriate guide for your situation.

* [Creating an SSH Key on Windows](/connection-methods/sftp/ssh-key-authentication/creating-an-ssh-key-on-windows.md)
* [Creating an SSH Key on Linux](/connection-methods/sftp/ssh-key-authentication/creating-an-ssh-key-on-linux.md)
* [Creating an SSH Key on macOS](/connection-methods/sftp/ssh-key-authentication/creating-an-ssh-key-on-macos.md)

### Uploading Your Key

To use your key with ExaVault, first connect to the system through SFTP using a password.

When you connect to SFTP, a virtual directory named `.ssh` appears in your home folder. Upload your public key file to that directory. This step is only available over SFTP — the `.ssh` directory does not appear in the web interface or other access methods.

### Using Your Key

After your public key is in the `.ssh` directory, configure your SFTP client to use your private key for authentication. The exact steps vary by SFTP client.

Command-line clients on Linux and macOS accept the `-i` option to specify the private key:

```bash
sftp -i /path/to/my_ssh_key.key username@files.example.com
```

## Removing Your Key

To disable access for a particular SSH key, connect to the SFTP server and delete the public key from the `.ssh` directory in your home folder.

## Supported Key Types

ExaVault supports two SSH key formats: RSA and ed25519.

All public keys must be provided in OpenSSH format when uploading or configuring them in your user profile or automation system.

## SSH Keys Come In Pairs

An SSH key is a matched pair: a public key and a corresponding private key. Generating an SSH key always produces both halves together.

The private key must never be shared. Keep it under the control of the person, script, or system that connects to the SFTP account. Treat it as a credential.

The public key does not need to be secret. Add it only to systems where the holder of the corresponding private key should be allowed to authenticate.

Never share a private key. When exchanging SSH keys for use with SFTP or SSH access, only send the public key.

## No Shell Access

SSH keys grant access to the SFTP service only. Even with a valid key, users cannot open an interactive shell or terminal session on the server. The environment is restricted to file transfer.