vesslctl ssh-key

List, add, and delete SSH public keys from the CLI.

The ssh-key command (alias: ssh-keys) lets you manage the SSH public keys associated with your VESSL Cloud account. Keys are referenced by slug (unique identifier) — pass that slug to vesslctl workspace create --ssh-key to attach a key when launching a workspace.

list

List all SSH keys registered to your account.

vesslctl ssh-key list

The output shows each key’s slug, name, fingerprint, and creation time. Copy the slug to use with other commands.

Column	Description
SLUG	Unique identifier — pass to --ssh-key flags
NAME	Human-readable name you set when adding the key
FINGERPRINT	SHA-256 fingerprint of the public key
CREATED	When the key was registered, in RFC 3339 format

add

Register a new SSH public key. You can either upload an existing public key file or have VESSL generate a new keypair on the server.

vesslctl ssh-key add --name <name> --public-key-file <path>

Flag	Required	Description
--name	Yes	Human-readable name for the key (for example, macbook-personal)
--public-key-file	Conditional	Path to a public key file (typically ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub). Required unless --generate is used.
--generate	Conditional	Generate a new keypair on the server. The private key is printed once and not stored — save it immediately. Mutually exclusive with --public-key-file.

Example — upload an existing public key:

vesslctl ssh-key add \
  --name macbook-personal \
  --public-key-file ~/.ssh/id_ed25519.pub

Example — generate a new keypair on the server:

vesslctl ssh-key add --name temporary-runner --generate

The command prints the slug of the newly registered key. Use that slug with vesslctl workspace create --ssh-key <ssh-key-slug>.

The --generate option prints the private key to your terminal exactly once and does not store it on the server. Save the output to a file (for example, ~/.ssh/<key-name>) and chmod 600 it before closing the session, or you will lose access to the key.

delete

Delete an SSH key by slug.

vesslctl ssh-key delete <ssh-key-slug>

Flag	Short	Description
--yes	-y	Skip the confirmation prompt

Example:

vesslctl ssh-key delete macbook-personal-abc123 --yes

Deleting a key only removes it from your VESSL Cloud account. Workspaces that already had the key attached at creation continue to accept it until they are terminated.