How to Git Push With SSH Key

To push a Git branch with an SSH key, create a key pair, add the public key to your Git hosting account, point the repository remote at its SSH URL, then push the branch you intend to publish. The private key stays on your machine. SSH authenticates you to the host; the host separately checks whether your account can write to that repository.

Generate an SSH key pair

If you do not already have a key for this account, generate an Ed25519 pair with ssh-keygen. The example below creates a disposable pair to demonstrate the command without changing your usual ~/.ssh files. Run it in a POSIX shell; it does not change your SSH configuration.

set -e
key_dir=$(mktemp -d)
trap 'rm -rf "$key_dir"' EXIT
ssh-keygen -q -t ed25519 -C "git@example.com" -f "$key_dir/id_ed25519" -N ""
test -s "$key_dir/id_ed25519.pub"
printf 'Created the Ed25519 public key file.\n'

Created the Ed25519 public key file.

This demonstration uses -N "" to set an empty passphrase, so ssh-keygen does not ask interactive questions. For a persistent key, omit -f to accept the default save location or provide a path such as ~/.ssh/id_ed25519_work; ssh-keygen prompts for the save location and then a passphrase. Enter a passphrase to protect the key at rest, or press Enter twice to leave it empty. The private key is the file without .pub; keep it secret and do not upload it. The .pub file is the public key. If you already have a suitable key pair, you can use it instead of generating another one.

Add the public key to your Git hosting account

Display the public key file you chose (for example, with cat ~/.ssh/id_ed25519.pub) and copy its complete line. In your Git host’s account settings, open the SSH key section and add that public key. GitHub, GitLab, and other providers use different page names and account policies, so follow the instructions for your provider. Never paste or upload the private key.

Configure SSH for one or multiple keys

SSH can use its default key selection, or a host alias can select a particular identity when you use multiple accounts or keys. Add this complete entry to ~/.ssh/config:

Run this command to print a complete example entry, then copy it into ~/.ssh/config:

cat <<'SSH_CONFIG'
Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_work
    IdentitiesOnly yes
SSH_CONFIG

The ~/.ssh/id_ed25519_work path is a placeholder; replace it with the path to your private key. The Git remote must use the same github-work alias as the Host entry. Use the path to your private key for IdentityFile. IdentitiesOnly yes tells SSH to offer the configured identity rather than cycling through other identities from an agent. Use a distinct alias and key path for another account. The alias in the Git remote must exactly match the Host value. File permissions and SSH agent startup vary by operating system and shell; if you use an agent, load the private key with ssh-add after starting the agent in the way supported by your environment. This step is optional when SSH can read the key directly.

Set the repository’s SSH remote

In the local repository, inspect the configured remote with git remote -v. For a GitHub SSH remote the form is git@github.com:OWNER/REPOSITORY.git; replace both placeholders with the account or organization and repository. Change the existing origin with git remote set-url origin git@github.com:OWNER/REPOSITORY.git, then run git remote -v again to confirm it shows the SSH URL. Keep the existing remote name if it is not origin.

If you configured an alias such as github-work, use that alias in the URL, for example git@github-work:OWNER/REPOSITORY.git. For another host, use the SSH URL shown by that provider. A URL that still starts with https:// uses HTTPS authentication, so changing keys will not affect it until the remote is changed to SSH.

Commit and push changes

Choose the files to include and stage them explicitly, such as with git add path/to/file; use git add . only when all changes in the current directory belong in this commit. Create a commit with git commit -m "Describe the change". Then push the intended branch with git push origin BRANCH, replacing origin and BRANCH with the remote and branch names used by your repository. For the first push of a branch, git push -u origin BRANCH also records its upstream.

Verify SSH authentication and troubleshoot common failures

Test the host connection with ssh -T git@github.com, or substitute your SSH alias (for example, ssh -T git@github-work). The host’s response depends on the provider; some hosts confirm your account but do not provide an interactive shell. Authentication only proves which account the key identifies. It does not prove that account has permission to push to this repository, and a provider may use a nonzero exit status for a successful authentication greeting.

If the test identifies the wrong account or cannot authenticate, check that the public key was added to that account, IdentityFile names the matching private key, and the remote uses the matching Host alias. ssh -vT git@github-work can show which identity SSH offers; review the diagnostic output locally and do not share private key contents. Also confirm the remote URL with git remote -v. If authentication succeeds but a push is rejected, check repository write access, the branch name, and any host-side branch rules.

If a private key is lost or exposed, create a replacement pair, add its public key to the host, update the SSH configuration or remote as needed, and remove the old public key from the account. A public key is intended to be shared with the Git host; the private key must remain secret.