Reference guide

GitHub SSH Keys on Linux

Generate a proper ed25519 key, wire it into the ssh-agent, upload it to GitHub, and never type a password again. Pick your distro.

// Why SSH over HTTPS?

HTTPS asks for your credentials on every push. SSH authenticates silently with a key pair — set it up once, forget about it forever.

→ No password prompts
→ Secure ed25519 keys
→ Works with ssh-agent
→ One key, all repos
→ Multi-account support
→ Required for deploy keys
1
Check for existing SSH keys
Before generating anything new, check if you already have a key pair in ~/.ssh. If you see id_ed25519.pub or id_rsa.pub, skip to step 3.
bash
ls -al ~/.ssh
ℹIf ~/.ssh doesn't exist yet, that's fine — ssh-keygen will create it automatically.
2
Generate a new ed25519 key
Use ed25519 — faster and more secure than the older RSA approach. Replace the email with the one on your GitHub account.
bash
ssh-keygen -t ed25519 -C "you@example.com"
💡When prompted for a file location, press Enter to accept the default (~/.ssh/id_ed25519). Add a passphrase for extra security — you'll only type it once per session thanks to ssh-agent.
3
Add the key to ssh-agent
The agent holds your decrypted key in memory so you're not prompted for a passphrase on every push.
bash
# Start the agent
eval "$(ssh-agent -s)"

# Register your key
ssh-add ~/.ssh/id_ed25519
ℹPersist across reboots on Fedora: Enable the systemd user socket so the agent starts automatically: systemctl --user enable --now ssh-agent, then add export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket" to your ~/.zshrc.
4
Copy your public key to the clipboard
Install a clipboard utility and pipe the public key into it. Only ever share the .pub file — the private key never leaves your machine.
bash
# Install xclip (X11) or wl-clipboard (Wayland)
sudo dnf install -y xclip

# Copy to clipboard — X11
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard

# Or if you're on Wayland (common on Fedora 43+)
sudo dnf install -y wl-clipboard
cat ~/.ssh/id_ed25519.pub | wl-copy
💡Not sure which display server you're on? Run echo $XDG_SESSION_TYPE. If it says wayland, use wl-copy.
5
Add the key to GitHub
In your browser, navigate to github.com → Settings → SSH and GPG keys → New SSH key. Paste your public key, give it a recognisable title (e.g. fedora43-laptop), and click Add SSH key.
⚠Make sure there are no trailing newlines or extra spaces when you paste. The key must start with ssh-ed25519 and end with your email address.
6
Test the connection
bash
ssh -T git@github.com

// Expected output

If everything is wired up correctly you'll see:

output
Hi username! You've successfully authenticated,
but GitHub does not provide shell access.

All git operations over SSH URLs will now authenticate silently.

+1
Configure ~/.ssh/config for multiple accounts
If you use more than one GitHub account (personal + work), map different hostnames to different keys.
~/.ssh/config
# Personal account
Host github.com
  HostName     github.com
  User         git
  IdentityFile ~/.ssh/id_ed25519

# Work account
Host github-work
  HostName     github.com
  User         git
  IdentityFile ~/.ssh/id_ed25519_work
Clone work repos with: git clone git@github-work:ORG/REPO.git
TL;DR
The whole thing in one block
bash — full setup
# 1. Generate key
ssh-keygen -t ed25519 -C "you@example.com"

# 2. Start agent + add key
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# 3. Install clipboard tool + copy public key
sudo dnf install -y xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
# (Wayland: sudo dnf install -y wl-clipboard && cat ~/.ssh/id_ed25519.pub | wl-copy)

# 4. Paste into github.com → Settings → SSH and GPG keys

# 5. Test
ssh -T git@github.com
1
Check for existing SSH keys
bash
ls -al ~/.ssh
ℹIf you see id_ed25519.pub or id_rsa.pub, you already have a key. Skip to step 3.
2
Generate a new ed25519 key
bash
ssh-keygen -t ed25519 -C "you@example.com"
💡Press Enter to accept the default save location. Add a passphrase — you'll only type it once per session.
3
Add the key to ssh-agent
bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ℹPersist across reboots: Ubuntu's GNOME Keyring often handles this automatically. If not, add eval "$(ssh-agent -s)" and ssh-add ~/.ssh/id_ed25519 to your ~/.bashrc or ~/.zshrc.
4
Copy your public key to the clipboard
bash
# Install xclip
sudo apt install -y xclip

# Copy to clipboard — X11
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard

# Or on Wayland (Ubuntu 22.04+)
sudo apt install -y wl-clipboard
cat ~/.ssh/id_ed25519.pub | wl-copy
💡Check your session type with echo $XDG_SESSION_TYPE. Ubuntu 22.04+ defaults to Wayland on supported hardware.
5
Add the key to GitHub
Go to github.com → Settings → SSH and GPG keys → New SSH key. Paste your key, give it a title (e.g. ubuntu-desktop), and click Add SSH key.
⚠The pasted key must start with ssh-ed25519 and end with your email — no extra whitespace.
6
Test the connection
bash
ssh -T git@github.com

// Expected output

output
Hi username! You've successfully authenticated,
but GitHub does not provide shell access.
TL;DR
The whole thing in one block
bash — full setup
ssh-keygen -t ed25519 -C "you@example.com"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
sudo apt install -y xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
# Paste into github.com → Settings → SSH and GPG keys
ssh -T git@github.com
1
Check for existing SSH keys
bash
ls -al ~/.ssh
ℹIf you see id_ed25519.pub or id_rsa.pub, you already have a key. Skip to step 3.
2
Generate a new ed25519 key
bash
ssh-keygen -t ed25519 -C "you@example.com"
3
Add the key to ssh-agent
bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
⚠Debian Stable may ship an older openssh-client. If ssh-keygen -t ed25519 fails, run sudo apt install -y openssh-client to ensure you have a current version.
4
Copy your public key to the clipboard
bash
# Install xclip
sudo apt install -y xclip

# Copy to clipboard
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard

# No clipboard tool available? Just print and copy manually:
cat ~/.ssh/id_ed25519.pub
5
Add the key to GitHub
Go to github.com → Settings → SSH and GPG keys → New SSH key. Paste your key, give it a title (e.g. debian-machine), and click Add SSH key.
⚠The pasted key must start with ssh-ed25519 and end with your email — no extra whitespace.
6
Test the connection
bash
ssh -T git@github.com

// Expected output

output
Hi username! You've successfully authenticated,
but GitHub does not provide shell access.
TL;DR
The whole thing in one block
bash — full setup
ssh-keygen -t ed25519 -C "you@example.com"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
sudo apt install -y xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
# Paste into github.com → Settings → SSH and GPG keys
ssh -T git@github.com
🏹 Arch / Manjaro: OpenSSH is usually already installed. The process is identical to other distros — only the clipboard package manager differs.
1
Check for existing SSH keys
bash
ls -al ~/.ssh
ℹIf you see id_ed25519.pub or id_rsa.pub, skip to step 3.
2
Generate a new ed25519 key
bash
ssh-keygen -t ed25519 -C "you@example.com"
3
Add the key to ssh-agent
bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ℹPersist on Arch: Enable the systemd user socket with systemctl --user enable --now ssh-agent and set SSH_AUTH_SOCK in your shell config. Alternatively, KDE Wallet and GNOME Keyring both handle this automatically if you're using a full desktop.
4
Copy your public key to the clipboard
bash
# X11
sudo pacman -S xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard

# Wayland
sudo pacman -S wl-clipboard
cat ~/.ssh/id_ed25519.pub | wl-copy
5
Add the key to GitHub
Go to github.com → Settings → SSH and GPG keys → New SSH key. Paste your key, give it a title (e.g. arch-desktop), and click Add SSH key.
⚠The key must start with ssh-ed25519 and end with your email — no extra whitespace.
6
Test the connection
bash
ssh -T git@github.com

// Expected output

output
Hi username! You've successfully authenticated,
but GitHub does not provide shell access.
TL;DR
The whole thing in one block
bash — full setup
ssh-keygen -t ed25519 -C "you@example.com"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
sudo pacman -S xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
# Paste into github.com → Settings → SSH and GPG keys
ssh -T git@github.com
🌿 Linux Mint is Ubuntu/Debian-based — the process is identical to Ubuntu. Just swap in your Mint machine name where prompted for a key title.
1
Check for existing SSH keys
bash
ls -al ~/.ssh
ℹIf you see id_ed25519.pub or id_rsa.pub, skip to step 3.
2
Generate a new ed25519 key
bash
ssh-keygen -t ed25519 -C "you@example.com"
3
Add the key to ssh-agent
bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ℹMint's desktop environment (Cinnamon, MATE, or Xfce) may manage the ssh-agent automatically via GNOME Keyring. If you're not being prompted for your passphrase repeatedly, it's already working.
4
Copy your public key to the clipboard
bash
sudo apt install -y xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
💡Alternatively, open ~/.ssh/id_ed25519.pub in a text editor and select all → copy. The result is the same.
5
Add the key to GitHub
Go to github.com → Settings → SSH and GPG keys → New SSH key. Paste your key, give it a title (e.g. mint-laptop), and click Add SSH key.
⚠The key must start with ssh-ed25519 and end with your email — no extra whitespace.
6
Test the connection
bash
ssh -T git@github.com

// Expected output

output
Hi username! You've successfully authenticated,
but GitHub does not provide shell access.
TL;DR
The whole thing in one block
bash — full setup
ssh-keygen -t ed25519 -C "you@example.com"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
sudo apt install -y xclip
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
# Paste into github.com → Settings → SSH and GPG keys
ssh -T git@github.com

Troubleshooting

Permission denied (publickey) ▶
Three things to check: (1) Is your key loaded? Run ssh-add -l — if it returns "The agent has no identities", run ssh-add ~/.ssh/id_ed25519. (2) Did you add the public key (.pub) to GitHub, not the private one? (3) Is your remote URL using SSH, not HTTPS? Check with git remote -v — it should start with git@github.com, not https://.
Asked for passphrase on every push ▶
The ssh-agent isn't running or your key isn't loaded into it. Run eval "$(ssh-agent -s)" followed by ssh-add ~/.ssh/id_ed25519. To make this permanent on Fedora, enable the systemd user socket: systemctl --user enable --now ssh-agent and add export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket" to your ~/.zshrc. On Ubuntu/Mint, GNOME Keyring usually handles this automatically.
Still prompted for username and password after setup ▶
Your remote is using HTTPS, not SSH. Check with git remote -v. If you see https://github.com/..., update it: git remote set-url origin git@github.com:USER/REPO.git. Replace USER and REPO with your actual GitHub username and repository name.
ssh -T returns "Host key verification failed" ▶
GitHub's host key isn't in your ~/.ssh/known_hosts file, or it changed. The safest fix: run ssh-keyscan github.com >> ~/.ssh/known_hosts to add the current key. Then retry. If you've connected before and it's suddenly changed, that's worth investigating before proceeding.
Pushing to the wrong GitHub account ▶
If you have multiple keys, SSH may be using the wrong one. Check which key is being used with ssh -vT git@github.com and look for the "Offering public key" line. To fix, set up a ~/.ssh/config file (see the bonus step in any distro panel above) mapping different host aliases to different keys, then update your remote URL to use the alias: git remote set-url origin git@github-work:ORG/REPO.git.