Guides: Understanding deploy keys

Deploy keys are a handy yet misunderstood feature here on github. This guide will try to lay out when and how to use them instead of normal user keys.

What are deploy keys?

Deploy keys are ssh keys just like the ones you attach to your account to allow you to push to and pull from your repos. The key difference is that deploy keys are designed to allow access to a single private repo. This is intended for use on your staging or production server to pull in from your repo, most likely using a deploy tool like Capistrano.

Remember, keys are unique, you cannot use the same key on two repos, or on a repo and a user account.

When should I use a deploy key?

Simple, when you have a server that needs pull access to a single private repo.

I’m working with public repos, do I still need deploy keys?

No! You can simply use the public clone URL for the project.

My server needs access to many private repos, how do I handle this?

The best way

The best way is to add your server’s key to the account for the repos’ owner. This will allow the server access to any private repo that user owns or is a collaborator on.

Create a server specific account

If you don’t want your deploy server to have access to every repo, you can make an account specifically for the server, attach its key to the account, and add that account as a collaborator to any repo you do want access to. Another option is to use multiple deploy keys and employ the technique described in the Multiple GitHub Accounts guide. Note that this method is somewhat complicated.

Use SSH config file

Open

~/.ssh/config

Host project1
    User git
    Hostname github.com
    IdentityFile [local path to private key half of github public key you provided]

Then for the git clone command use project1 instead of github.com

git clone git@project1:user/project.git

Further reading

• Providing your SSH Key
• Deploying with Capistrano
• Multiple GitHub Accounts