The ssh-key command (alias: ssh-keys) lets you manage the SSH public keys associated with your VESSL Cloud account. Keys are referenced by slug (unique identifier) — pass that slug to vesslctl workspace create --ssh-key to attach a key when launching a workspace.
list
List all SSH keys registered to your account.
The output shows each key’s slug, name, fingerprint, and creation time. Copy the slug to use with other commands.
| Column | Description |
|---|
SLUG | Unique identifier — pass to --ssh-key flags |
NAME | Human-readable name you set when adding the key |
FINGERPRINT | SHA-256 fingerprint of the public key |
CREATED | When the key was registered, in RFC 3339 format |
add
Register a new SSH public key. You can either upload an existing public key file or have VESSL generate a new keypair on the server.
vesslctl ssh-key add --name <name> --public-key-file <path>
| Flag | Required | Description |
|---|
--name | Yes | Human-readable name for the key (for example, macbook-personal) |
--public-key-file | Conditional | Path to a public key file (typically ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub). Required unless --generate is used. |
--generate | Conditional | Generate a new keypair on the server. The private key is printed once and not stored — save it immediately. Mutually exclusive with --public-key-file. |
vesslctl ssh-key add \
--name macbook-personal \
--public-key-file ~/.ssh/id_ed25519.pub
vesslctl ssh-key add --name temporary-runner --generate
vesslctl workspace create --ssh-key <ssh-key-slug>.
The --generate option prints the private key to your terminal exactly once and does not store it on the server. Save the output to a file (for example, ~/.ssh/<key-name>) and chmod 600 it before closing the session, or you will lose access to the key.
delete
Delete an SSH key by slug.
vesslctl ssh-key delete <ssh-key-slug>
| Flag | Short | Description |
|---|
--yes | -y | Skip the confirmation prompt |
vesslctl ssh-key delete macbook-personal-abc123 --yes
Deleting a key only removes it from your VESSL Cloud account. Workspaces that already had the key attached at creation continue to accept it until they are terminated.
