Add An SSH Key

Updated 2 October 2026

An SSH key is a pair of files on your computer. One half is public and you give it away. The other half is private and never leaves your machine. When you connect, the server checks that you hold the private half without ever seeing it.

That is better than a password in every way that matters: there is nothing to guess, nothing to type, and nothing worth stealing at the other end. A key is required for both SFTP and WP-CLI; there is no password option. The same key list serves both.

If you already have a key you use elsewhere, skip to step 3.

Step 1: Check For An Existing Key

Open a terminal. On Windows, use PowerShell or the terminal in your code editor.

ls ~/.ssh

If you see id_ed25519 and id_ed25519.pub, you already have a key pair and can go on to step 3. If the folder does not exist or is empty, make one.

Step 2: Generate A Key

ssh-keygen -t ed25519 -C "your@email"

You will be asked three things.

Where to save it. Press Enter to accept the default, ~/.ssh/id_ed25519.
A passphrase. Set one. It encrypts the private key on disk, so a stolen laptop is not a stolen key. Your operating system’s keychain will remember it so you are not typing it all day.
The same passphrase again.

You now have two files:

File	What it is	Who sees it
`~/.ssh/id_ed25519`	The private key	Nobody, ever
`~/.ssh/id_ed25519.pub`	The public key	This is the one you paste in

Only ever paste the file ending in .pub. If what you are about to paste begins with -----BEGIN OPENSSH PRIVATE KEY-----, stop: that is the private half. Delete the pair and start again, because a private key that has been pasted anywhere should be treated as compromised.

The ed25519 type is the current standard. It is shorter and faster than the older RSA keys and there is no reason to choose anything else for a new key. Existing RSA, ECDSA and hardware (FIDO) keys are accepted too; an RSA key shorter than 2048 bits is refused.

Step 3: Copy The Public Key

cat ~/.ssh/id_ed25519.pub

It prints one long line that starts with ssh-ed25519 and ends with the comment you set. Copy the whole line, including the ssh-ed25519 at the front and with no line breaks in the middle.

On macOS you can send it straight to the clipboard:

pbcopy < ~/.ssh/id_ed25519.pub

On Windows PowerShell:

Get-Content ~/.ssh/id_ed25519.pub | Set-Clipboard

Step 4: Add It In The Members Area

Sign in at my.oxyforge.com, open the website, and go to its SFTP tab. A key is added per website, in the Keys card, and opens that one website only. If you work on several sites, add the same public key on each of them.

Paste the line into the key field, give it a name you will recognise later such as work-laptop, and save. The key reaches the server within a few seconds.

Name keys after the machine they live on rather than after the person. When you replace a laptop, you then know exactly which key to remove.

Step 5: Test It

sftp -P 2222 USERNAME@HOST

Use the user and host from the site’s SFTP tab. The port is 2222. If the key is working you land in your web root without being asked for anything, though you may be asked for your key’s passphrase the first time in a session.

To test a key for WP-CLI instead, run one command as the oxywp user:

ssh -p 2222 oxywp@HOST wp core version

It prints your WordPress version, provided WP-CLI is switched on for the site. There is no shell to land in.

The first connection will ask you to confirm the server’s fingerprint. Type yes once.

Managing Keys

Add a key per machine rather than copying one private key between computers. That way losing one machine means removing one key and nothing else changes.

Remove a key the moment it is no longer needed: a developer whose work has finished, or a laptop you have sold. The removal reaches the server within a few seconds and does not affect any other key.

A key gives whatever is switched on for that site: SFTP, WP-CLI, or both. Each is its own switch on the SFTP tab and both are off until you turn them on. A key never logs anybody in to WordPress. Those are separate, and removing a WordPress user does not remove their key.

Troubleshooting

“Permission denied (publickey)”. The server has not accepted the key, and there is no password to fall back to. Check you pasted the .pub file, that the whole line went in including the ssh-ed25519 prefix, that no line break crept into the middle of it, and that the thing you are trying to use (SFTP or WP-CLI) is switched on for the site.

“Permissions 0644 for id_ed25519 are too open”. SSH refuses to use a private key other people on your machine could read.

chmod 600 ~/.ssh/id_ed25519

Your client is not offering the key. Point it at the private key file by hand:

sftp -i ~/.ssh/id_ed25519 -P 2222 USERNAME@HOST

In FileZilla, set Logon Type to Key file and browse to the same path.

You have lost the private key. There is no recovery and there is nothing to recover: generate a new pair, add the new public key, and delete the old one from the members area.

“Connection refused”. The port again. It is 2222.

Did this answer it? If not, open a ticket from the members area and someone who runs the platform will pick it up.

Open A Ticket