Skip to main content
Register, list, and delete SSH public keys on your Ornn account so they can be authorized on VM and Bare Metal reservations. Ornn uses SSH public keys to authorize you on every reservation, whether you use VM or Bare Metal access. You register one or more public keys on your account, then add a key to a reservation when you activate access. Keys are scoped to your tenant and can be managed from both the web app and the Ornn Compute CLI. Three terms are used throughout the access guides:
  • Register a key on your account: click Add public key on the SSH keys tab of the Account page (or run ornn ssh-keys add).
  • Add a key to a reservation: click Add Key in the reservation’s SSH Keys section. From the CLI, run ornn access keys add <reservation-id> ....
  • Launch the reservation: Ornn authorizes the reservation’s active keys on the host.

​
Prerequisites

  • An SSH key pair generated locally. If you don’t have one, run:
  • The public key only (~/.ssh/id_ed25519.pub) is uploaded to Ornn. Never share or upload the private key.
Ed25519, RSA, and ECDSA public keys are all supported. Ed25519 is recommended for new keys, but you can register an existing ssh-rsa or ecdsa-sha2-* key if you already use one.

​
Add a key (web app)

1

Open the SSH keys tab

Go to the Account page (/account) and open the SSH keys tab.
2

Find the Add key form

On the SSH keys tab, use the Add key form at the top.
3

Enter the key details

Enter a Name to identify the key (for example, laptop or ci-runner), then paste the full contents of your .pub file into the SSH public key field.
4

Add the key

Click Add public key. The key appears under Saved keys with its name, fingerprint, status, and added date.

​
Add a key (CLI)

Paste the key inline:
Or read it from a file:
The --label value is the CLI equivalent of the web Name field. Add --json to get the new key record as structured output, including its id, which you’ll need to add the key to a reservation.

​
List keys

Web app: the SSH keys tab on the Account page lists every registered key. CLI:
Each entry shows the key id, label, and fingerprint. Add --json for the full record, including the creation timestamp.

​
Add a key to a reservation

Keys are not automatically pushed to every reservation. You add a specific key when you activate access for a reservation. Web app: open the reservation detail page at /portfolio/[reservationId], select your access mode, and use Add Key in the SSH Keys section. You can add a key before or after launch. Before launch, Ornn saves it for provisioning. After launch, Ornn associates it with each active VM or Bare Metal node shown in the grouped reservation. The SSH access update is queued immediately, so no relaunch is required.
The SSH Keys tab and panel are hidden when the reservation has no underlying compute reservation yet — for example, a reservation created through the exchange that hasn’t been picked up for provisioning. Attaching a key requires a compute reservation, so the section reappears once one exists. A compute reservation that exists but hasn’t launched a node still shows the section, since registering keys before launch is supported.
For an active Slurm cluster, adding a saved or reservation key refreshes the login SSH access without relaunching workers. CLI: ornn nodes launch queues VM or Bare Metal access and installs the key on the reservation’s machines.
Get the <key-id> from ornn ssh-keys list, which prints each registered key’s id. --key also accepts a saved key label, inline public key, or public-key file path. If you pass a private key path by mistake and the matching .pub file exists, the CLI uses the public key file and refuses to upload private key material. To add a key to an active reservation, use Add Key on the reservation detail page. Ornn queues it for every active VM or Bare Metal node in that grouped reservation. From the CLI, add the key directly to the reservation:
The reservation command also queues the updated key set on any active machines for that reservation. To re-sync a key that is already attached, run:

​
Delivery status

Each key in a reservation’s SSH Keys section shows a status label that reflects delivery across every active VM or Bare Metal node in the reservation:
  • Registered: the key is on your account and attached to the reservation, but Ornn has not confirmed it is installed on every active machine. This is the state for reservations that haven’t launched.
  • Queued: Ornn is pushing the key to at least one active machine. The reservation page keeps polling until the update finishes.
  • Installed: the key is applied on every active machine in the reservation and ready to use.
  • Failed: the key push failed on at least one machine. If another machine is still queued, polling continues until every push settles.
Use Push key (or ornn access keys push) to retry a failed delivery.

​
Delete a key

Deleting a key revokes it from your account immediately. For every running machine (VM or Bare Metal) where that key was authorized, Ornn queues a key update that re-pushes your remaining active keys and drops the deleted one. The removal takes effect once the host applies the queued update; a host that is not currently running has the deleted key dropped the next time it is launched. Add or push a replacement key before deleting a key you still need.
Web app: on the SSH keys tab of the Account page, click Delete next to the key. CLI:

​
What’s next

vm-access

VM access

Activate a managed VM and attach an SSH key to your reservation.
bare-metal-access

Bare Metal access

Attach an SSH key for direct host access on a Bare Metal reservation.