> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/authentication/manage-public-keys.md).

# Manage public keys

Add and manage SSH and GPG public keys in your Harness user profile.

When you add a Secure Shell (SSH) or GNU Privacy Guard (GPG) public key to your Harness user profile, Harness uses it to verify that actions like [signing commits](/code-repository/use-harness-code/collaborate-and-develop/signing-commits.md) actually come from you. This gives your team confidence that commits are authentic and untampered.

{% hint style="info" %}
Harness recommends SSH keys. Most developers already have an SSH key pair and an SSH agent set up, so there is nothing extra to install. Choose GPG if your organization requires OpenPGP signatures, or if you need key expiration and revocation, which SSH keys do not support.
{% endhint %}

***

### What you will learn in this topic

By the end of this topic, you will know how to:

* Generate an SSH or GPG key pair on your local machine.
* Add an SSH or GPG public key to your Harness user profile.
* Delete a key from your profile when it is no longer needed.

***

### Before you begin

Before you manage SSH and GPG public keys, ensure you have the following:

* **Harness account**: An active Harness account. For instructions on setting one up, see the [Onboarding guide](/harness-platform/new-to-harness-platform/get-started.md).
* **SSH client (for SSH keys)**: An SSH client installed on your machine.
* **GPG tools (for GPG keys)**: GPG command-line tools installed on your machine.

***

### Generate a key pair and add it to Harness

Use the **SSH Key** tab unless you have a specific reason to use GPG.

{% tabs %}
{% tab title="SSH Key" %}

#### Step 1: Generate the key pair

Open a terminal and run:

```bash
ssh-keygen -t ed25519 -C "your_email@example.com"
```

Replace `your_email@example.com` with the email address associated with your Harness account.

{% hint style="info" %}
**ED25519 NOT SUPPORTED?**

If your system does not support Ed25519, use RSA instead:

```bash
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
```

{% endhint %}

When prompted, provide the following:

1. **File location:** Press **Enter** to accept the default (`~/.ssh/id_ed25519`).
2. **Passphrase:** Enter a secure passphrase (recommended) or press **Enter** for no passphrase.

#### Step 2: Start the SSH agent

```bash
eval "$(ssh-agent -s)"
```

#### Step 3: Add the key to the SSH agent

**macOS:**

Open or create the `~/.ssh/config` file and add the following lines:

```
cat >> ~/.ssh/config << 'EOF'
Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519
EOF
```

This appends the config lines to the file (and creates it if it does not exist).

Then add the key:

```bash
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
```

**Linux:**

```bash
ssh-add ~/.ssh/id_ed25519
```

**Windows (Git Bash):**

```bash
ssh-add ~/.ssh/id_ed25519
```

#### Step 4: Copy the public key

**macOS:**

```bash
pbcopy < ~/.ssh/id_ed25519.pub
```

**Linux:**

```bash
xclip -selection clipboard < ~/.ssh/id_ed25519.pub
```

**Windows (Git Bash):**

```bash
clip < ~/.ssh/id_ed25519.pub
```

Alternatively, open the file and copy its contents manually:

```bash
cat ~/.ssh/id_ed25519.pub
```

#### Step 5: Add the public key to Harness

1. In Harness, select your avatar to open your **User Profile**.
2. Select the **Public keys** tab.
3. Add a key. If you have no keys yet, the tab shows **No public keys yet** with an **Add a public key to get started** prompt.
4. In the **Public Key** panel, fill in the following fields:
   * **Name** (required): A descriptive name for the key. Harness suggests a name and derives an **Id** from it. To change the identifier, select the edit icon next to **Id**.
   * **Key type** (required): Select **SSH**.
   * **Public Key** (required): Paste the contents of your `.pub` file.
   * **Metadata** (optional): Expand this section to add a description or tags.
5. Select **Save**.

Harness confirms the key and adds it to your **Public keys** list with its fingerprint.

You can now use the key to sign commits. Harness verifies the signature against this public key and marks signed commits as **Verified**, confirming the commit came from you and has not been altered.

{% hint style="info" %}
If **SSH** is not available as a **Key type**, the `CODE_SSH_ENABLED` feature flag is off for your account. Contact [Harness Support](mailto:support@harness.io) to enable it.
{% endhint %}
{% endtab %}

{% tab title="GPG Key" %}

#### Step 1: Install GPG

Download and install the GPG command-line tools for your operating system:

* **macOS**: `brew install gnupg`
* **Windows**: Download [Gpg4win](https://www.gpg4win.org/).
* **Linux**: GPG is usually pre-installed. If not, use your package manager (for example, `sudo apt install gnupg`).

#### Step 2: Generate the key pair

Open a terminal and run:

```bash
gpg --full-generate-key
```

When prompted, provide the following:

1. **Key type**: Select **RSA and RSA**.
2. **Keysize**: Enter `4096` for maximum security.
3. **Expiration**: Press **Enter** for no expiration, or specify an expiration period.
4. **Confirm** your selections.
5. **User ID:** Enter your real name and the email address associated with your Harness account.
6. **Passphrase**: Enter a secure passphrase.

#### Step 3: Find your key ID

List your GPG secret keys:

```bash
gpg --list-secret-keys --keyid-format=long
```

In the output, find the `sec` line. The key ID follows the algorithm and key size. For example, in `sec rsa4096/3AA5C34371567BD2`, the key ID is `3AA5C34371567BD2`.

#### Step 4: Export the public key

Export your public key in ASCII armor format:

```bash
gpg --armor --export <YOUR_KEY_ID>
```

Copy the entire output, including the `-----BEGIN PGP PUBLIC KEY BLOCK-----` and `-----END PGP PUBLIC KEY BLOCK-----` lines.

#### Step 5: Add the public key to Harness

1. In Harness, select your avatar to open your **User Profile**.
2. Select the **Public keys** tab.
3. Add a key. If you have no keys yet, the tab shows **No public keys yet** with an **Add a public key to get started** prompt.
4. In the **Public Key** panel, fill in the following fields:
   * **Name** (required): A descriptive name for the key. Harness suggests a name and derives an **Id** from it. To change the identifier, select the edit icon next to **Id**.
   * **Key type** (required): Select **GPG**.
   * **Public Key** (required): Paste the full block you exported, beginning with `-----BEGIN PGP PUBLIC KEY BLOCK-----`.
   * **Metadata** (optional): Expand this section to add a description or tags.
5. Select **Save**.

Harness confirms the key and adds it to your **Public keys** list, showing the key name and fingerprint.

You can now use the key to sign commits. Harness verifies the signature against this public key and marks signed commits as **Verified**, giving your team confidence that the commit is authentic and has not been tampered with.
{% endtab %}
{% endtabs %}

***

### Delete a public key

Deleting a key stops Harness from verifying new signatures against it. Commits that were already verified with the key keep their **Verified** status.

1. Open your **User Profile** and select the **Public keys** tab.
2. Locate the key you want to remove.
3. Select **More Options** (⋮) on the key card.
4. Select **Delete**.
5. Confirm the deletion in the dialog.

***

### Next steps

* [Sign commits](/code-repository/use-harness-code/collaborate-and-develop/signing-commits.md): Use your SSH or GPG keys to sign commits in Harness Code Repository.
* [Two-factor authentication](/harness-platform/3.0/harness-platform-resources/authentication/two-factor-authentication.md): Add a second verification step to your Harness login.

{% @harness-feedback/feedback %}