authorized_keys options builder

Paste a public key, tick the restrictions you want, and copy the finished authorized_keys line. Nothing leaves your browser, and private keys are refused.

Public key The single line from a .pub file, such as ~/.ssh/id_ed25519.pub. Public keys only: never paste a private key here or into any web page.

restrict turn on every restriction: no port, agent or X11 forwarding, no terminal, no ~/.ssh/rc pty allow a terminal again, so you still get an interactive shell port-forwarding allow port forwarding again

from (optional)

Comma-separated addresses, CIDR ranges or patterns the connection must come from.

command (optional) Runs this command every time the key is used. Whatever the client asked to run is ignored.

permitopen (optional) Limit ssh -L forwarding to these host:port destinations, comma-separated. Use * for any port.

expiry-time

Comment A label for you. sshd does not use it for anything.

~/.ssh/authorized_keys

Add it on the server

The file format

Each line of ~/.ssh/authorized_keys holds one key, as space-separated fields: options, key type, base64-encoded key, comment. The options field is optional. It is a comma-separated list with no spaces, except inside double quotes, and option names are case-insensitive. Empty lines and lines starting with # are ignored. A line can be up to 8 kilobytes long.

restrict,pty,from="100.64.0.0/10" ssh-ed25519 AAAAC3Nz… phone

What each option does

Option	Effect
`restrict`	Enables all restrictions: no port, agent or X11 forwarding, no PTY allocation, no `~/.ssh/rc`. Restrictions added to OpenSSH later are included too.
`pty`, `port-forwarding`	Give back one capability that `restrict` took away. `agent-forwarding`, `X11-forwarding` and `user-rc` work the same way.
`from="pattern-list"`	The client's address must match the comma-separated list. Wildcards and CIDR ranges such as `192.168.1.0/24` are allowed; `!` negates a pattern.
`command="command"`	Runs this command whenever the key is used and ignores the one the client sent, which is left in `SSH_ORIGINAL_COMMAND`.
`no-port-forwarding`	Forbids TCP forwarding; forwarding requests return an error.
`no-agent-forwarding`	Forbids authentication agent forwarding.
`no-X11-forwarding`	Forbids X11 forwarding.
`no-pty`	Prevents tty allocation, so a request for a terminal fails.
`permitopen="host:port"`	Limits `ssh -L` forwarding to that destination. Hosts are literal, with no pattern matching; a port of `*` matches any port. Repeat the option for more destinations.
`expiry-time="timespec"`	A time after which the key is not accepted, as `YYYYMMDD` or `YYYYMMDDHHMM[SS]`. It is read in the server's time zone unless it ends in `Z` for UTC.

Things that catch people out

restrict takes away the terminal. For a key you log in with, use restrict,pty.
from wants addresses. sshd's UseDNS defaults to no, and then only addresses, not host names, work in from.
command alone does not block forwarding. The client can still ask for TCP or X11 forwarding unless you prohibit it, so pair it with restrict. A ForceCommand in sshd_config can supersede it.
permitopen needs forwarding allowed. With restrict, add port-forwarding as well.
Permissions. If the file, ~/.ssh or your home directory is writable by other users, sshd will not use the file unless StrictModes is off. The commands under the result set the usual 700 and 600.

Public keys only

This page needs only the public half of a key pair, the one-line .pub file. If you paste something with a BEGIN … PRIVATE KEY line, the box is cleared and nothing is built from it. A private key belongs on the device that made it. Melta, our phone app for coding agents over SSH (for iPhone and Android), generates the key on the phone and keeps it in the iOS Keychain or Android Keystore, and its setup command adds the public key to this file for you.

Common questions

What is the format of the authorized_keys file?

One public key per line, as space-separated fields: optional options, the key type, the base64-encoded key and a comment. The default location is ~/.ssh/authorized_keys, and empty lines and lines starting with # are ignored.

How do I restrict an SSH key to one IP address?

Put from="203.0.113.5" in front of the key, or a CIDR range such as from="192.168.1.0/24". Use addresses, because host names in from only work when the server sets UseDNS yes.

What does restrict do in authorized_keys?

It enables every restriction at once: port, agent and X11 forwarding are disabled, along with PTY allocation and execution of ~/.ssh/rc. Add pty after it if the key still needs an interactive terminal.

How do I make an SSH key expire?

Add expiry-time="YYYYMMDD" or expiry-time="YYYYMMDDHHMM" in front of the key. The time is read in the server's time zone unless you end it with Z for UTC.

How do I limit an SSH key to a single command?

Use restrict,command="/path/to/script". The command runs whenever the key is used, whatever the client asked for, and restrict closes off forwarding and the terminal as well.

Why is sshd ignoring my authorized_keys file?

Most often permissions: if the file, the ~/.ssh directory or your home directory is writable by other users, sshd refuses to use it unless StrictModes is set to no. Run chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, and check that the key is on a single line.