Secure SSH & Git

Keep private keys in the vault. Git and SSH should sign through Authsia’s agent — not by exporting keys into the shell.

Adopt keys

Preview, then import existing keys into a vault folder such as Infra/SSH.

Point SSH at Authsia

Enable shell integration and confirm the agent lists identities.

Headless signing uses a separate SSH-only credential. Shell integration and authsia exec obtain Bridge-issued, process- or terminal-bound leases without writing the bearer into the runtime grant file.

Git

Use the same agent for git fetch, git push, and SSH-based remotes. Do not copy private key files into agent-readable workspace paths.

Automation

Create a separate SSH automation credential when a script needs signing without an interactive session: