> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gpuoutlet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH keys

> How we inject your public key into every pod, and what we never see.

GPU Outlet uses SSH for everything interactive. You connect with
`ssh -i ~/.ssh/<your-key> root@host -p port` — pass your private key with `-i`
unless it's your default `~/.ssh/id_ed25519`.

## What we store

When you paste a public key into **Settings → SSH keys**, we store:

* The literal public-key string (the `ssh-ed25519 AAAA…` line)
* A name you provided (`macbook-2026`)
* A SHA256 fingerprint (computed server-side for display)
* A `createdAt` timestamp

That's it. We **never** see your private key. We **never** ask for it.
We **never** generate keys on your behalf — generating happens on your
machine via `ssh-keygen`.

## When keys are injected

Every key you have on file **at the moment you create a rental** is written into
the machine's `/root/.ssh/authorized_keys` at first boot. Adding a key after an
instance starts does **not** retroactively grant access to it — you'd add it
manually inside that instance, or just launch a new one.

## Recommended algorithm

We strongly prefer **Ed25519**:

```bash theme={null}
ssh-keygen -t ed25519 -C "you@gpuoutlet.com"
```

RSA 4096 also works:

```bash theme={null}
ssh-keygen -t rsa -b 4096 -C "you@gpuoutlet.com"
```

We reject anything weaker than RSA 2048 server-side. The API responds
`400 weak_key` if you try to add it.

## Rotation

Because keys are injected when a rental is created, rotate by overlapping:

1. Generate a new key on your machine
2. Add it via the dashboard (you'll have two on file now)
3. Launch a fresh instance and confirm the new key connects
4. Delete the old key from the dashboard

Keeping both on file during the switch lets you verify before removing the old
one. Do it in this order — delete first and you'd lock yourself out of any
instance you launch until you re-add.

## Multiple keys per account

There's no limit. Real-world examples:

* One key per machine you SSH from (laptop, workstation, CI runner)
* One key per teammate, all sharing the account (until we ship Teams — see
  [Teams](/guides/teams))
* One key per CI pipeline

Every key is injected into every new pod. To restrict per-pod access, run
your own `authorized_keys` management inside the pod.

## Deletion

Deleting a key in the dashboard:

* Immediately removes it from our store
* Does NOT remove it from already-running pods (we don't have shell access
  to your pods after boot)
* Means subsequent pods won't have it

To revoke access to a running pod, either stop the pod and start a new one,
or SSH in and edit `/root/.ssh/authorized_keys` directly.