> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.vessl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# vesslctl ssh-key

> List, add, and delete SSH public keys from the CLI.

The `ssh-key` command (alias: `ssh-keys`) lets you manage the SSH public keys associated with your VESSL Cloud account. Keys are referenced by slug (unique identifier) — pass that slug to `vesslctl workspace create --ssh-key` to attach a key when launching a workspace.

## list

List all SSH keys registered to your account.

```bash theme={null}
vesslctl ssh-key list
```

The output shows each key's slug, name, fingerprint, and creation time. Copy the slug to use with other commands.

| Column        | Description                                     |
| ------------- | ----------------------------------------------- |
| `SLUG`        | Unique identifier — pass to `--ssh-key` flags   |
| `NAME`        | Human-readable name you set when adding the key |
| `FINGERPRINT` | SHA-256 fingerprint of the public key           |
| `CREATED`     | When the key was registered, in RFC 3339 format |

## add

Register a new SSH public key. You can either upload an existing public key file or have VESSL generate a new keypair on the server.

```bash theme={null}
vesslctl ssh-key add --name <name> --public-key-file <path>
```

| Flag                | Required    | Description                                                                                                                                              |
| ------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--name`            | Yes         | Human-readable name for the key (for example, `macbook-personal`)                                                                                        |
| `--public-key-file` | Conditional | Path to a public key file (typically `~/.ssh/id_ed25519.pub` or `~/.ssh/id_rsa.pub`). Required unless `--generate` is used.                              |
| `--generate`        | Conditional | Generate a new keypair on the server. The private key is printed once and not stored — save it immediately. Mutually exclusive with `--public-key-file`. |

**Example — upload an existing public key:**

```bash theme={null}
vesslctl ssh-key add \
  --name macbook-personal \
  --public-key-file ~/.ssh/id_ed25519.pub
```

**Example — generate a new keypair on the server:**

```bash theme={null}
vesslctl ssh-key add --name temporary-runner --generate
```

The command prints the slug of the newly registered key. Use that slug with `vesslctl workspace create --ssh-key <ssh-key-slug>`.

<Warning>
  The `--generate` option prints the private key to your terminal exactly once and does not store it on the server. Save the output to a file (for example, `~/.ssh/<key-name>`) and `chmod 600` it before closing the session, or you will lose access to the key.
</Warning>

## delete

Delete an SSH key by slug.

```bash theme={null}
vesslctl ssh-key delete <ssh-key-slug>
```

| Flag    | Short | Description                  |
| ------- | ----- | ---------------------------- |
| `--yes` | `-y`  | Skip the confirmation prompt |

**Example:**

```bash theme={null}
vesslctl ssh-key delete macbook-personal-abc123 --yes
```

<Note>
  Deleting a key only removes it from your VESSL Cloud account. Workspaces that already had the key attached at creation continue to accept it until they are terminated.
</Note>