Deploy Keys

A deploy key is an SSH key that gives one machine, such as a CI runner or a server, access to a single repository without tying it to a personal account.

Adding a Deploy Key

Generate a key pair on the machine, for example with ssh-keygen -t ed25519
Navigate to your API repository and select the Settings tab
Go to Deploy Keys
Under New Deploy Key, enter a Key name, such as CI server
Paste the contents of the .pub file into Public key
Tick Allow write access only if the machine must push
Click Add Deploy Key

Deploy Key Settings page with one read-only key and the New Deploy Key form

The Allow write access checkbox is unchecked by default, so a new deploy key is read-only.

After you add a key, APIGit shows its fingerprint. To compare it with your key file, run:


$ ssh-keygen -l -f /path/to/your/key.pub

A deploy key cannot also be a personal SSH key, and a repository cannot list the same key twice. Generate a separate key pair for each machine.

Using a Deploy Key

The machine connects like any other SSH client. See Clone over SSH for the address, the host key fingerprints and port 443. A successful test with the key prints:


Hi! You've successfully authenticated to APIGit with the deploy key "<key name>".
APIGit does not provide shell access; use this key with git clone, fetch and push.

Managing Deploy Keys

The Keys list shows each key’s name, the date it was added, when it was last used and its fingerprint. The label next to it reads Read-only or Read & write.

To remove a key, click Delete Key and confirm. The key loses access to the repository at once, and this cannot be undone.

Deploy keys are not available on a repository synchronized with a third-party Git provider.