Manage SSH keys for compute access

Register public keys for VM, Bare Metal, and Slurm access, then verify that the key you need is installed. VM and Bare Metal use reservation SSH keys. Slurm uses saved account keys when the cluster launches; its cluster page manages login access. You register one or more public keys on your account; VM and Bare Metal launches add every active account key to the reservation by default, and you can still pick a specific key when you activate access. Keys are scoped to your tenant and can be managed from the web app, the Ornn Compute CLI, and the REST API. Three terms are used throughout the access guides:

Register a key on your account: open SSH Keys in the sidebar and click Add key, enter the key details and confirm Add key, or run ornn ssh-keys add.
Add a key to a reservation: click Add key in the reservation’s SSH Keys section. From the CLI, run ornn ssh-keys assignments assign <reservation-id> --key <key-id>.
Launch the reservation: Ornn queues the reservation’s active keys for the host. Queued is not installed. With no key selection, every active key on your account is added and queued.

Holding a reservation, or a filled spot bid, does not put the key on the machine. The VM still has to become ready, then the key still has to install. Wait for the installed label before you SSH.

Prerequisites

An SSH key pair generated locally. If you don’t have one, run:
ssh-keygen -t ed25519 -C "you@company.com"
The public key only (~/.ssh/id_ed25519.pub) is uploaded to Ornn. Never share or upload the private key.

Ed25519, RSA, and ECDSA public keys are all supported. Ed25519 is recommended for new keys, but you can register an existing ssh-rsa or ecdsa-sha2-* key if you already use one.

Add a key (web app)

Open SSH Keys

Open SSH Keys in the sidebar (/ssh-keys).

Add a key

Click Add key in the header or empty state and choose Import public key. The same form is available from reservation and cluster setup, and Cluster Users; paste a public key or choose Upload .pub.

Enter the key details

Enter a Key name to identify the key (for example, laptop or ci-runner), then paste the full contents of your .pub file into the SSH public key field.

Add the key

Click Add key. The dialog closes and the key appears in the list with its name, fingerprint, and added date.

Generate a key in the web app

If you don’t have a key pair, click Add key, choose Generate key, enter a Key name, and click Generate and download. Ornn saves the public key to your account, and your browser downloads the private key as a .pem file. A toast confirms that the public key was saved and the private key download started. Ornn does not store the private key, and the download happens only once. Browsers save downloads with permissions that other users on your computer can read, and SSH refuses to use a private key like that. Restrict the file to your user before you connect:

# macOS / Linux
chmod 600 ~/Downloads/<name>.pem

# Windows PowerShell
icacls "$env:USERPROFILE\Downloads\<name>.pem" /inheritance:r /grant:r "$($env:USERNAME):(R)"

Move the file somewhere private, such as ~/.ssh/, and delete any other copies. If anyone else could have read the file, revoke the key on SSH Keys and generate a new one. ornn connect --identity-file refuses a private key that other users can read.

Add a key (CLI)

Paste the key inline:

ornn ssh-keys add --public-key "ssh-ed25519 AAAAC3Nz... you@company.com" --label laptop

Or read it from a file:

ornn ssh-keys add --public-key-file ~/.ssh/id_ed25519.pub --label laptop

The --label value is the CLI equivalent of the web Key name field. For scripted key creation, follow the CLI interaction contract, including an explicit output format and stable idempotency key.

List keys

Web app: SSH Keys in the sidebar shows active keys by default. If you have revoked keys, expand Revoked keys below the active list to load their history, including revocation dates. Active keys stay visible while you browse history. Use Load more active keys or Load more revoked keys when more entries are available. CLI:

ornn ssh-keys list
ornn ssh-keys list --format json

The CLI lists up to 50 active keys per page. Set --limit to change the page size and pass page.next_cursor from JSON output to --cursor to continue. Each entry shows the key id, label, and fingerprint. Add --format json for the full record, including the creation timestamp.

Add a key to a reservation

Reservations use your organization’s keys by default: launching without a key selection queues every active organization key for the machine, including VMs launched automatically after a Spot purchase. Add a specific key when you want to choose which keys a reservation uses — a selection replaces the default. Web app: open the reservation detail page at /portfolio/[reservationId], select your access mode, and use Add key in the SSH Keys section. You can add a key before or after launch. Before launch, Ornn saves it for provisioning. After launch, Ornn associates it with each active VM or Bare Metal node shown in the grouped reservation. The SSH access update is queued immediately, so no relaunch is required. A queued update is not the same as an installed key.

The SSH Keys tab and panel are hidden when the reservation has no underlying compute reservation yet — for example, a reservation created through the exchange that hasn’t been picked up for provisioning. Attaching a key requires a compute reservation, so the section reappears once one exists. A compute reservation that exists but hasn’t launched a node still shows the section, since registering keys before launch is supported.

For Slurm, open the cluster’s SSH keys tab to add a saved key and refresh login access. Check the authorized fingerprint before connecting. See Slurm access. CLI: ornn launch queues VM or Bare Metal access and queues the key for those machines. --wait waits for the machine. The Linux login is tenant. The key is ready for SSH only after delivery shows installed.

ornn launch <reservation-id> --key <key-id> --mode bare-metal
ornn launch <reservation-id> --key ~/.ssh/id_ed25519.pub --mode vm --wait

Get the <key-id> from ornn ssh-keys list, which prints each registered key’s id. --key also accepts a saved key label, inline public key, or public-key file path. If you pass a private key path by mistake and the matching .pub file exists, the CLI uses the public key file and refuses to upload private key material. To add a key to an active reservation, use Add key on the reservation detail page. Ornn queues it for every active VM or Bare Metal node in that grouped reservation. Wait for Registered · Installed on node (or Installed on all N nodes) before you SSH with that key. From the CLI, add the key directly to the reservation:

ornn ssh-keys add --public-key-file ~/.ssh/id_ed25519.pub --label laptop
ornn ssh-keys assignments assign <reservation-id> --key laptop

The reservation command also queues the updated key set on any active machines for that reservation. To re-sync the keys already attached to the reservation, run:

ornn ssh-keys assignments sync <reservation-id>

Your reservation’s saved keys load using your signed-in account and selected organization. If you see Sign in again to continue, sign in again and reopen the reservation.

Delivery status

Each key in a reservation’s SSH Keys section shows a status label that reflects delivery across every active VM or Bare Metal node in the reservation. Queued is not installed. Use the key for SSH only after the installed label appears on every machine you need. If the reservation has no keys yet, the section shows No SSH keys and asks you to add a public key before you can access your nodes.

Label	What it means
Registered to reservation	The key is attached to the reservation. No active machine has received it yet. This is the usual state before launch.
Registered · Awaiting sync	The reservation has at least one machine, but Ornn has not confirmed the key on every machine.
Registered · Sync queued	Ornn is pushing the key to at least one active machine. The page keeps polling. This is not ready for SSH.
Registered · Installed on node / Installed on all N nodes	The key is applied on every active machine in the reservation and ready to use.
Registered · Sync failed	The key push failed on at least one machine. If another machine is still queued, polling continues until every push settles.

When a reservation has no keys, use Add all account keys to attach all your active account keys and queue their delivery. Once keys are attached, use Add to reservation to add another account key individually. A successful queue is still not an install. Removing a key from a VM or Bare Metal reservation queues the remaining keys for its machines. If no keys remain on the reservation, it returns to its default and every active key on your account is queued again. To stop a key from working on every reservation, revoke it. Once a machine applies the update, new SSH connections using a removed key are denied; existing sessions stay connected.

Revoke a key

Revoking a key removes it from your active account keys immediately. In the web app, Ornn also makes a best effort to detach it from your VM and Bare Metal reservations for everyone in your organization and queue the remaining active reservation keys for their machines. After account revocation succeeds, cleanup waits at most 30 seconds; remaining cleanup attempts stop when that limit is reached. Removal takes effect when a machine applies the update; successful account revocation does not confirm removal from every machine. Add or push a replacement key before revoking a key you still need.

Web app: on SSH Keys, hover over a key’s row or focus it with the keyboard to reveal Revoke. On touch screens, Revoke stays visible. Click Revoke to revoke the key. Re-adding the same public key reactivates its account record without pushing it to machines. Add it to a reservation explicitly to restore an association that was removed. CLI:

ornn ssh-keys delete <key-id>

Use the API

Every task on this page is also available over REST with an API key. Account keys belong to your organization, so the key routes take your organization id from GET /v1/auth/session. These routes require an approved organization.

export ORNN_API="https://api.ornn.com"
export ORG_ID="$(curl --fail-with-body --silent "$ORNN_API/v1/auth/session" \
  -H "Authorization: Bearer $ORNN_API_KEY" | jq -er '.organizations[0].id')"
export RESERVATION_ID='<reservation-id>'

Add a key and assign it to a reservation

CLI
REST
Python

ornn ssh-keys add --public-key-file ~/.ssh/id_ed25519.pub --label laptop
ornn ssh-keys assignments assign "$RESERVATION_ID" --key laptop

jq -n --arg key "$(cat ~/.ssh/id_ed25519.pub)" '{public_key: $key, label: "laptop"}' \
  > ssh-key.json

curl --fail-with-body -X POST "$ORNN_API/v1/organizations/$ORG_ID/ssh-keys" \
  -H "Authorization: Bearer $ORNN_API_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary @ssh-key.json > ssh-key-response.json
export KEY_ID="$(jq -er '.id' ssh-key-response.json)"

jq -n --arg id "$KEY_ID" '{ssh_key_id: $id}' |
  curl --fail-with-body -X POST \
    "$ORNN_API/v1/orchestrator/nodes/reservations/$RESERVATION_ID/ssh-keys" \
    -H "Authorization: Bearer $ORNN_API_KEY" \
    -H 'Content-Type: application/json' \
    --data-binary @-

import os
from pathlib import Path

import requests

API = "https://api.ornn.com"
http = requests.Session()
http.headers["Authorization"] = f"Bearer {os.environ['ORNN_API_KEY']}"
reservation_id = os.environ["RESERVATION_ID"]

session = http.get(f"{API}/v1/auth/session", timeout=30)
session.raise_for_status()
org_id = session.json()["organizations"][0]["id"]

public_key = (Path.home() / ".ssh" / "id_ed25519.pub").read_text().strip()
created = http.post(
    f"{API}/v1/organizations/{org_id}/ssh-keys",
    json={"public_key": public_key, "label": "laptop"},
    timeout=30,
)
created.raise_for_status()
key = created.json()

assigned = http.post(
    f"{API}/v1/orchestrator/nodes/reservations/{reservation_id}/ssh-keys",
    json={"ssh_key_id": key["id"]},
    timeout=60,
)
assigned.raise_for_status()
print(key["id"], key["fingerprint"], key["outcome"])

Adding a key returns 201 with outcome created for a new key. It returns 200 with already_registered when your organization already has that public key; your label is not applied. Send only the .pub file, never the private key. Assigning the key returns 201 and queues delivery to the reservation’s active VM and Bare Metal machines. The first key you assign replaces the default of every account key. You can also skip the first request: send {"public_key": "...", "label": "laptop"} to the assignment route to register and assign a new key in one call. To read keys, call List organization SSH keys with status=active&limit=100 and follow next_cursor, or List a reservation’s SSH keys for the keys a reservation uses.

Check delivery

A queued key is not installed. Poll the reservation’s nodes and wait until each machine reports the key’s fingerprint:

CLI
REST

ornn ssh-keys assignments status "$RESERVATION_ID"

export FINGERPRINT="$(jq -er '.fingerprint' ssh-key-response.json)"

curl --fail-with-body \
  "$ORNN_API/v1/orchestrator/nodes?reservation_id=$RESERVATION_ID" \
  -H "Authorization: Bearer $ORNN_API_KEY" |
  jq --arg fp "$FINGERPRINT" '.nodes[] | {
    node_id,
    installed: (.authorized_key_fingerprints // [] | index($fp) != null),
    failures: [(.authorized_key_metadata // [])[] | select(.status == "failed")]
  }'

Each node from List reserved GPU nodes reports authorized_key_fingerprints for installed keys and authorized_key_metadata with status installed or failed and a failure_reason. Connect only after the fingerprint appears on every machine you need. Poll every few seconds with a deadline.

Push keys again

If a machine was offline or a delivery failed, queue the reservation’s keys for that machine again. Pass the host node ID: a Bare Metal node’s node_id, or for a VM, the node_id from the reservation’s VM list, not the VM’s own id. Ornn updates that host and the reservation’s VMs on it:

CLI
REST

ornn ssh-keys assignments sync "$RESERVATION_ID"

export NODE_ID='<node-or-vm-id>'

jq -n --arg id "$KEY_ID" '{ssh_key_ids: [$id]}' |
  curl --fail-with-body -X POST \
    "$ORNN_API/v1/orchestrator/nodes/$NODE_ID/push-keys" \
    -H "Authorization: Bearer $ORNN_API_KEY" \
    -H 'Content-Type: application/json' \
    --data-binary @-

Push SSH keys to a machine queues the reservation’s full key set, not only the keys you list. Machines in a Kubernetes or Slurm cluster return 409.

Remove or revoke a key

Unassign a key from a reservation to remove an assignment you made. Revoke the key to remove it from your account and, on a best-effort basis, from every VM and Bare Metal reservation in your organization:

curl --fail-with-body -X DELETE \
  "$ORNN_API/v1/orchestrator/nodes/reservations/$RESERVATION_ID/ssh-keys/$KEY_ID" \
  -H "Authorization: Bearer $ORNN_API_KEY"

curl --fail-with-body -X DELETE \
  "$ORNN_API/v1/organizations/$ORG_ID/ssh-keys/$KEY_ID" \
  -H "Authorization: Bearer $ORNN_API_KEY"

The revoke request can take up to 30 seconds while Ornn queues removal from your machines. A successful response does not confirm that every machine has applied it; check delivery as above.

What’s next

VM access

Activate a managed VM and attach an SSH key to your reservation.

Bare Metal access

Attach an SSH key for direct host access on a Bare Metal reservation.

When adding a key from a reservation, cluster, or Cluster Users, choose Generate key to generate it on your device. Download the private key, then choose Add key to save and use the public key.

Get Started

Buy and sell

Supplier

Accessing Compute

Storage

Nodes

Account

Manage SSH keys for compute access

Prerequisites

Add a key (web app)

Generate a key in the web app

Add a key (CLI)

List keys

Add a key to a reservation

Delivery status

Revoke a key

Use the API

Add a key and assign it to a reservation

Check delivery

Push keys again

Remove or revoke a key

What’s next

VM access

Bare Metal access

​Prerequisites

​Add a key (web app)

​Generate a key in the web app

​Add a key (CLI)

​List keys

​Add a key to a reservation

​Delivery status

​Revoke a key

​Use the API

​Add a key and assign it to a reservation

​Check delivery

​Push keys again

​Remove or revoke a key

​What’s next

VM access

Bare Metal access

Prerequisites

Add a key (web app)

Generate a key in the web app

Add a key (CLI)

List keys

Add a key to a reservation

Delivery status

Revoke a key

Use the API

Add a key and assign it to a reservation

Check delivery

Push keys again

Remove or revoke a key

What’s next