Generate a key
You need an SSH key pair before you can open a shell on an instance. If you already have one, reuse it. Check what you have:
ls ~/.ssh/*.pub
Any .pub file listed there is a public key you can add to Superheat, as long as its type is on the supported list. If there is nothing there, generate a pair.
Generate an ed25519 key
ssh-keygen -t ed25519 -C "you@example.com"
ssh-keygen asks where to save the key and whether to set a passphrase. Press Enter to accept the default location.
The text after -C is a comment that travels with the public key. Anything that reminds you which machine the key lives on works.
Where the files land
| Path | What it is | Who gets to see it |
|---|---|---|
~/.ssh/id_ed25519 | private key | nobody — it never leaves your machine |
~/.ssh/id_ed25519.pub | public key | this is the half you paste into Superheat |
The public key is a single line:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8mQ2sT9vXbN1kR4pLwZ0aYcE7hJ6uD3fGgH5iKmNoP you@example.com
The file without the .pub extension is your private key, and it begins with -----BEGIN OPENSSH PRIVATE KEY-----. If you ever paste that into a form, a chat, or a ticket, generate a new pair and delete the old one.
Copy the public key
| Platform | Command |
|---|---|
| macOS | pbcopy < ~/.ssh/id_ed25519.pub |
| Linux, X11 | xclip -selection clipboard < ~/.ssh/id_ed25519.pub |
| Linux, Wayland | wl-copy < ~/.ssh/id_ed25519.pub |
If none of those are installed, print the file and copy it by hand. It is one line, and the whole line matters.
cat ~/.ssh/id_ed25519.pub
Permissions
OpenSSH refuses to use a private key that other users on the machine can read. If you restored ~/.ssh from a backup or copied it between machines, reset the modes:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
Passphrases
A passphrase encrypts the private key on disk, so a copy of the file is useless to whoever takes it. Set one.
The cost is typing it. ssh-agent holds the decrypted key for the rest of your session:
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
On macOS, store the passphrase in the login keychain so the agent picks the key up again after a reboot:
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
You can add, change, or remove a passphrase at any time. This rewrites the private key file only — the public key and its fingerprint stay the same, so a key you already added to Superheat keeps working:
ssh-keygen -p -f ~/.ssh/id_ed25519
On Windows
ssh-keygen ships with the OpenSSH client that is included in Windows 10 and Windows 11. Open PowerShell and run the same command:
ssh-keygen -t ed25519 -C "you@example.com"
The pair lands in C:\Users\<you>\.ssh\. Print the public key, or send it straight to the clipboard:
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard
To stop retyping the passphrase, start the agent service and load the key. The Set-Service line needs an administrator PowerShell and only has to be run once:
Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519
Two things that trip people up on Windows:
| Situation | What to do |
|---|---|
| You work in WSL | WSL has its own home directory, so ~/.ssh inside Linux is not C:\Users\<you>\.ssh. Generate the key in whichever environment you will run ssh from. |
| You use PuTTY | A .ppk file is not an OpenSSH public key. In PuTTYgen, copy the text out of the box labeled "Public key for pasting into OpenSSH authorized_keys file" — that is what Superheat accepts. |
Check the fingerprint
ssh-keygen -lf ~/.ssh/id_ed25519.pub
256 SHA256:Pr6lxPUhwJ7+VHus18B6LLkVm4mFu0L9hn8eqgpOyag you@example.com (ED25519)
The SHA256: value is what the console shows next to the key once you add it, which is how you tell two keys apart. See Supported key types.
When the key exists, add it to your account — before you deploy anything.