deploykeys

Deploy keys are SSH public keys that are added to a version control repository’s configuration to grant automated systems access to that repository. They are intended for machine-to-machine interactions, such as continuous integration, deployment scripts, or automated backups, and are separate from a user’s personal SSH keys. A deploy key typically gives access to a single repository, rather than to a user’s entire account.

In practice, a deploy key is created by a machine or service that needs access, generating a private/public key pair. The public key is stored in the repository’s deploy keys settings, and the private key remains on the machine used by the automation. Access can be restricted to read-only by default, with an option to enable write access if the workflow requires pushing changes back to the repository. This per-repo scope helps minimize exposure in case the key is compromised.

Setup generally involves generating a dedicated SSH key pair on the automation host, adding the public key to the repository’s deploy keys configuration, and securely storing the private key on the runner or server. It is best practice to use a distinct deploy key for each repository and to revoke a key promptly if the machine is decommissioned or compromised. Rotating keys and treating private keys as secrets—avoiding inclusion in code or logs—are important security measures.

Security considerations include limiting scope to a single repository, preferring read-only keys when possible, using separate keys per automation task, and promptly revoking keys. Some platforms also offer deploy tokens or similar mechanisms for HTTP-based access, which differ from SSH deploy keys. Deploy keys provide a straightforward, repository-scoped mechanism for automated access.