> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ornn.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage SSH keys for compute access

> Register, list, and delete SSH public keys on your Ornn account so they can be authorized on VM and Bare Metal reservations.

Ornn uses SSH public keys to authorize you on every reservation, whether you use VM or Bare Metal access. You register one or more public keys on your account, then add a key to a reservation when you activate access. Keys are scoped to your tenant and can be managed from both the web app and the Ornn Compute CLI.

Three terms are used throughout the access guides:

* **Register** a key on your account: click **Add public key** on the **SSH keys** tab of the Account page (or run `ornn ssh-keys add`).
* **Add** a key to a reservation: click **Add Key** in the reservation's **SSH Keys** section (or run `ornn access activate` for Bare Metal).
* **Launch** the reservation: Ornn authorizes the reservation's active keys on the host.

## Prerequisites

* An SSH key pair generated locally. If you don't have one, run:
  ```bash theme={null}
  ssh-keygen -t ed25519 -C "you@company.com"
  ```
* The **public** key only (`~/.ssh/id_ed25519.pub`) is uploaded to Ornn. Never share or upload the private key.

## Add a key (web app)

<Steps>
  <Step title="Open the SSH keys tab">
    Go to the Account page (`/account`) and open the **SSH keys** tab.
  </Step>

  <Step title="Find the Add key form">
    On the **SSH keys** tab, use the **Add key** form at the top.
  </Step>

  <Step title="Enter the key details">
    Enter a **Name** to identify the key (for example, `laptop` or `ci-runner`), then paste the full contents of your `.pub` file into the **SSH public key** field.
  </Step>

  <Step title="Add the key">
    Click **Add public key**. The key appears under **Saved keys** with its name, fingerprint, status, and added date.
  </Step>
</Steps>

## Add a key (CLI)

Paste the key inline:

```bash theme={null}
ornn ssh-keys add --public-key "ssh-ed25519 AAAAC3Nz... you@company.com" --label laptop
```

Or read it from a file:

```bash theme={null}
ornn ssh-keys add --public-key-file ~/.ssh/id_ed25519.pub --label laptop
```

The `--label` value is the CLI equivalent of the web **Name** field. Add `--json` to get the new key record as structured output, including its `id`, which you'll need to add the key to a reservation.

## List keys

**Web app:** the **SSH keys** tab on the Account page lists every registered key.

**CLI:**

```bash theme={null}
ornn ssh-keys list
ornn ssh-keys list --json
```

Each entry shows the key `id`, label, and fingerprint. Add `--json` for the full record, including the creation timestamp.

## Add a key to a reservation

Keys are not automatically pushed to every reservation. You add a specific key when you activate access for a reservation.

**Web app:** open the reservation detail page at `/portfolio/[reservationId]`, select your access mode, and use **Add Key** in the **SSH Keys** section to add a key to the reservation before launching. The key is installed on the reservation's machines, and launch authorizes the active reservation keys on the host.

**CLI (Bare Metal):** `ornn access activate` queues Bare Metal access and installs the key on the reservation's machines. Configure VM access from the web reservation detail page.

```bash theme={null}
ornn access activate <reservation-id> --ssh-key-id <key-id>
ornn access activate <reservation-id> --ssh-key-id <key-id> --username worker
```

Get the `<key-id>` from `ornn ssh-keys list`, which prints each registered key's id.

To push an additional key to an already-active reservation:

```bash theme={null}
ornn access push-keys <reservation-id> --ssh-key-id <key-id>
```

## Delete a key

<Warning>
  Deleting a key revokes it from your account immediately. For every running machine (VM or Bare Metal) where that key was authorized, Ornn queues a key update that re-pushes your remaining active keys and drops the deleted one. The removal takes effect once the host applies the queued update; a host that is not currently running has the deleted key dropped the next time it is launched. Add or push a replacement key before deleting a key you still need.
</Warning>

**Web app:** on the **SSH keys** tab of the Account page, click **Delete** next to the key.

**CLI:**

```bash theme={null}
ornn ssh-keys delete <key-id>
```

## What's next

<CardGroup cols={2}>
  <Card title="VM access" img="https://mintcdn.com/ornn/fNQRwmmR9H-yzza5/images/banners/vm-access.jpg?fit=max&auto=format&n=fNQRwmmR9H-yzza5&q=85&s=11440154a7d2f11d5f64d61ac90c23c3" href="/guides/vm-access" width="1200" height="800" data-path="images/banners/vm-access.jpg">
    Activate a managed VM and attach an SSH key to your reservation.
  </Card>

  <Card title="Bare Metal access" img="https://mintcdn.com/ornn/fNQRwmmR9H-yzza5/images/banners/bare-metal-access.jpg?fit=max&auto=format&n=fNQRwmmR9H-yzza5&q=85&s=6276c46ea54e80732c14919ccb9661a1" href="/guides/bare-metal-access" width="1200" height="800" data-path="images/banners/bare-metal-access.jpg">
    Attach an SSH key for direct host access on a Bare Metal reservation.
  </Card>
</CardGroup>