SSH keys

Save the public SSH keys you use to log into pods. Add a key once, then pick it when you create a pod instead of pasting it every time.

There is no dedicated SSH keys screen in the console - you paste or pick a key right where you need it, under SSH Public Key (optional) on the create-pod form. This API is how you list and delete the keys you have saved.

All endpoints need a bearer token (JWT or API key). Listing needs sshkeys:read, adding sshkeys:create, deleting sshkeys:delete.

List keys

GET /api/ssh-keys/

A plain array, not a paginated envelope:

[
  {
    "id": "6a4d5b83b7006ccae6391810",
    "accountId": "6a4d5b83b7006ccae6391800",
    "name": "laptop",
    "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB9k7rY2xQ3cVvJ0mN4pR8sT1uW5xZ7aB2cD4eF6gH8i alice@laptop",
    "fingerprint": "SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU",
    "createdAt": "2026-07-01T09:12:00Z",
    "updatedAt": null
  }
]

Add a key

POST /api/ssh-keys/

{
  "name": "laptop",
  "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB9k7rY2xQ3cVvJ0mN4pR8sT1uW5xZ7aB2cD4eF6gH8i alice@laptop"
}

Paste the public key - the contents of ~/.ssh/id_ed25519.pub, not your private key. We compute the fingerprint for you and return 201 with the saved key.

If name is empty we fall back to the key's trailing comment, and if there isn't one we generate a name from the fingerprint (key- plus its last eight characters). Add a key you have already saved and we just hand back the existing one (keys are deduplicated by fingerprint), so re-adding is harmless and does not create a second row.

Accepted key types:

• ssh-rsa
• ssh-ed25519
• ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521
• [email protected], [email protected] (FIDO / hardware-backed keys)

Anything else is rejected with 400:

{ "message": "Invalid SSH public key; expected an OpenSSH key like 'ssh-ed25519 AAAA... comment'" }

A recognised type whose key body is not valid base64 gets { "message": "Invalid SSH public key encoding" }, also 400.

Delete a key

DELETE /api/ssh-keys/:keyId

{ "message": "SSH key deleted" }

Removes the key from your saved list. There is no update action - to rotate a key, delete this one and add the replacement. Deleting a saved key does not touch pods you already created with it; the key is still in their authorized_keys.

Using a key on a pod

When you create a pod you can attach one of these keys so you can SSH in straight away. See Connecting via SSH for the full walkthrough.

Example

curl -X POST https://cloud-api.microapps.io/api/ssh-keys/ \
  -H "Authorization: Bearer $MICROAPPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg k "$(cat ~/.ssh/id_ed25519.pub)" '{name:"laptop", publicKey:$k}')"