DevOpsPadDownload

SSH private key authentication

Choose Private key under SSH authentication, set Private key file to your key (for example ~/.ssh/id_ed25519), and enter Key passphrase if the key is encrypted. DevOpsPad reads the key from disk each time it opens a tunnel and stores only its path in the workspace file.

The passphrase, if any, is stored in the OS keychain. Leave the field empty for an unencrypted key.

Steps

  1. In the connection dialog, check Connect through SSH tunnel and fill in SSH host, SSH port and SSH username.
  2. Set SSH authentication to Private key.
  3. In Private key file, type a path or click the folder button to choose a file. Paths starting with ~/ are expanded to your home folder.
  4. If the key is encrypted, enter its Key passphrase.
  5. Configure host key verification; see verify host keys.
  6. Click Test connection, then Save connection.

Supported keys

DevOpsPad uses Go’s SSH implementation, which reads private keys in OpenSSH format and in PEM format, including Ed25519, ECDSA and RSA keys. Encrypted keys are unlocked with the passphrase you enter.

The key must be the private key file, not the .pub public key. The matching public key must be in the SSH user’s ~/.ssh/authorized_keys on the server.

Hardware-backed keys (for example FIDO sk- keys) and keys held only by a password manager are not read from a file; if your key lives in an agent, use SSH Agent authentication.

How secrets are kept

  • Private key file: stays where it is. DevOpsPad saves its path.
  • Key passphrase: saved in the keychain under a separate entry for the connection. When editing, the field shows Saved in keychain · leave blank to keep.
  • Switching to Password or SSH Agent, or turning the tunnel off, deletes the stored passphrase when you save.

Errors

Message Cause
SSH private key file is required Private key file is empty
Cannot read SSH private key file Wrong path, or the app cannot read the file
Cannot unlock SSH private key; check the key format and passphrase Wrong passphrase, missing passphrase for an encrypted key, or an unsupported key format
SSH connection failed: … unable to authenticate The server rejected the key or the username

For other tunnel errors, see SSH troubleshooting.

Frequently asked questions

Does DevOpsPad copy my private key?

No. It stores only the path to the key file and reads the file each time it opens a tunnel. The key never leaves your disk.

Where is the key passphrase stored?

In the OS keychain, in its own entry for that connection, separate from the database password.