# Add an SSH key

To open a shell or transfer files over SSH File Transfer Protocol (SFTP), you authorize an SSH key on
your host. TurboStack uses public-key authentication: you keep a private key, and you add the matching
public key to the host. This page shows how to create a keypair (if you do not have one) and how to
authorize it.

We recommend the **ed25519** key type. It is secure and fast, and it is the default across the
platform. Any OpenSSH-compatible key type also works.

## Step 1: Generate a keypair

If you already have a public key you want to use, skip to [Step 2](#step-2-add-your-key-to-the-host).
Otherwise choose one of the methods below.

### Mac, Linux, or Windows Subsystem for Linux (recommended)

Run `ssh-keygen` in a terminal:

```bash
ssh-keygen -t ed25519 -C "user@example.com"
```

- `-t ed25519` selects the ed25519 algorithm.
- `-C "user@example.com"` adds a comment so you can identify the key later.

You are prompted to:

- Choose where to save the key. Press `Enter` to accept the default `~/.ssh/id_ed25519`.
- Set a passphrase. This is optional but recommended - it protects the private key if it is stolen.

You now have two files:

- `id_ed25519` - your private key. Never share it.
- `id_ed25519.pub` - your public key. This is the one you add to the host.

Print the public key so you can copy it:

```bash
cat ~/.ssh/id_ed25519.pub
```

### Windows with PuTTY

If you use PuTTY, generate the key with PuTTYgen:

1. Download PuTTY from [the official source](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) if you do not have it.
2. Open **PuTTYgen** (`puttygen.exe`).
3. Under **Parameters**, select **EdDSA**, the Edwards-curve Digital Signature Algorithm (Ed25519 is
   the default curve).
4. Click **Generate** and move your mouse over the blank area to add randomness.
5. Copy the **public key** shown at the top of the window.
6. Click **Save private key** to store the private key (set a passphrase if you want).

> [!NOTE]
> If a tool needs the private key in OpenSSH format, use **Conversions > Export OpenSSH key** in
> PuTTYgen and save it.

## Step 2: Add your key to the host

Authorize the public key in the TurboStack interface:

1. Open your host.
2. Go to the **SSH** tab.
3. Paste your **public key** into the keys field.
4. Click **Save & Publish**.

TurboStack writes the authorized key for you - there is no need to edit any file on the server by
hand. Once published, you can connect over SSH with your private key.

> [!TIP]
> To grant the same key on many hosts at once, add it at the **group** level instead. Member hosts
> inherit group keys automatically. See [Configure SSH](configure.md) for the `ssh_keys` setting and
> group inheritance.

## On cPanel and DirectAdmin hosts

The flow above covers the default TurboStack host. If your host runs the cPanel or DirectAdmin
control panel, add the key through the panel's own SSH-key manager instead:

- **cPanel:** go to **Security > SSH Access > Manage SSH Keys**, import your public key, then
  authorize it.
- **DirectAdmin:** open the **SSH Keys** menu, add your public key, and make sure it is enabled.

## Related

- [Configure SSH](configure.md)
- [What is SSH?](what-is.md)
- [Host SSH tab](../../platform/hosts/ssh.md)
- [Security hardening](../../concepts/security-hardening.md)