Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

ssh has the -i option to tell which private key file to use when authenticating:

-i identity_file

    Selects a file from which the identity (private key) for RSA or DSA authentication is read.  The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2.  Identity files may also be specified on a per-host basis in the configuration file.  It is possible to have multiple -i options (and multiple identities specified in configuration files).

Is there a similar way to tell git which private key file to use on a system with multiple private keys in the ~/.ssh directory?

share|improve this question
See this question in StackOverflow as well. – Flimm May 8 at 9:46

7 Answers 7

up vote 208 down vote accepted

In ~/.ssh/config, add:

 IdentityFile ~/.ssh/id_rsa_github
 User git

Now you can do git clone

NOTE: Verify that the permissions on IdentityFile are 400.SSH will reject, in a not clearly explicit manner, SSH keys that are too readable. It will just look like a credential rejection. The solution, in this case, is:

chmod 400 ~/.ssh/id_rsa_github
share|improve this answer
What if you need to connect to the same host with different keys? – Valentin Klinghammer Nov 30 '12 at 11:24
@Quelltextfabrik - you can add another section with a different Host:… – Ben Challenor Dec 4 '12 at 14:17
I'm using this trick in my github-keygen tool that I built to manage SSH keys and settings for Github. – dolmen Sep 20 '13 at 10:10
@Grissiom You've got that backwards. Host can be anything, even wildcards and patterns; Hostname must have the hostname or IP address. Source: ssh_config manpage. – Cliff Jan 5 at 21:41
@Cliff Nop, in my manpage: "HostName: Specifies the real host name to log into. This can be used to specify nicknames or abbreviations for hosts." My ssh version is openssh-6.7p1. – Grissiom Jan 7 at 2:17

Write a script that calls ssh with the arguments you want, and put the filename of the script in $GIT_SSH. Or just put your configuration in ~/.ssh/config.

share|improve this answer
That's a handy trick – Bryan Agee May 30 '12 at 17:13
Another explanation of how to do this. – Sithsu May 12 '14 at 19:44
~/.ssh/config Is the way to go. – hek2mgl May 8 at 13:56

From Git version 2.3.0, you can use the environment variable GIT_SSH_COMMAND like this:

GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_example" git clone example

Note that -i can sometimes be overridden by your config file, in which case, you should give SSH an empty config file, like this:

GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_example -F /dev/null" git clone example
share|improve this answer

After my struggle with $GIT_SSH I would like to share what worked for me.

Through my examples I will assume you have your private key located at/home/user/.ssh/jenkins

Error to avoid: GIT_SSH value includes options

$ export GIT_SSH="ssh -i /home/user/.ssh/jenkins"

or whatever similar will fails, as git will try to execute the value as a file. For that reason, you have to create a script.

Working example of $GIT_SSH script /home/user/

The script will be invoked as follows:

$ $GIT_SSH [username@]host [-p <port>] <command>

Sample script working could look like:

ssh -i /home/user/.ssh/jenkins $*

Note the $* at the end, it is important part of it.

Even safer alternative, which would prevent any possible conflict with anything in your default config file (plus explicitly mentioning the port to use) would be:

ssh -i /home/user/.ssh/jenkins -F /dev/null -p 22 $*

Assuming the script is in /home/user/, you shall then:

$ export GIT_SSH=/home/user/

and all shall work.

share|improve this answer
Thanks... this one did exactly what I needed it to! – Jimbo Nov 5 at 16:19

You can just use ssh-ident instead of creating your own wrapper.

You can read more at:

It loads ssh keys on demand when first needed, once, even with multiple login sessions, xterms or NFS shared homes.

With a tiny config file, it can automatically load different keys and keep them separated in different agents (for agent forwarding) depending on what you need to do.

share|improve this answer

There is no direct way to tell git which private key to use, because it rely on ssh for repository authentication.

However you can use ssh-agent to temporary authorize your private key. In example:

$ ssh-agent sh -c 'ssh-add ~/.ssh/id_rsa; git fetch user@host'

Or you can pass the ssh arguments either by using GIT_SSH_COMMAND or GIT_SSH variable.

Example of using GIT_SSH_COMMAND (Git 2.3.0+):

$ GIT_SSH_COMMAND='ssh -i ~/.ssh/id_rsa -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' git clone user@host

Example of using GIT_SSH:

$ echo 'ssh -i ~/.ssh/id_rsa -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $*' > ssh
$ chmod +x ssh
$ GIT_TRACE=1 GIT_SSH='./ssh' git clone user@host

Note: Above lines are terminal command-lines which you should paste into your terminal. It'll create a file ssh, make it executable and executes it.

Alternatively use ~/.ssh/config file as suggested in other answers in order to specify your location of your private key.

share|improve this answer
// , What if your identity in ssh-agent is forwarded, though, as in this question?… – Nathan Basanese Sep 11 at 18:06

If you do not want to have to specify environment variables every time you run git, do not want another wrapper script, do not/can not run ssh-agent(1), nor want to download another package just for this, use the git-remote-ext(1) external transport:

$ git clone 'ext::ssh -i $HOME/.ssh/alternate_id %S /path/to/repository.git'
Cloning into 'repository'
$ cd repository
$ git remote -v
origin  ext::ssh -i $HOME/.ssh/alternate_id %S /path/to/repository.git (fetch)
origin  ext::ssh -i $HOME/.ssh/alternate_id %S /path/to/repository.git (push)

I consider this solution superior because:

  • It is repository/remote specific
  • Avoid wrapper script bloat
  • Do not need the SSH agent -- useful if you want unattended clones/push/pulls (e.g. in cron)
  • Definitely, no external tool needed
share|improve this answer
// , Excellent solution. I wonder, though, if this would allow one to specify an identity passed through using agent forwarding. Most of my keys are not local to the servers I am using them on. I asked about this here:… – Nathan Basanese Sep 11 at 18:09
The answer deals only with a way of specifying arbitrary command lines to be used as git repositories. IMHO, you should try to sort out your issue using ssh alone first (e.g. "ssh host" should connect using the right key). I will try to provide more info on your other question, though. – flaviovs Sep 14 at 16:34
Re my last comment, for some reason I cannot comment in your other question -- and do not have a concrete answer. Well, you might want to checkout… and the answer from user kasperd. – flaviovs Sep 14 at 17:51
This answer was exactly what I needed to force Chef's git resource to use repository-specific deployment keys to clone/fetch from private Github repositories. The additional advantage of this method over the environment/script based ones is that since the key-path is encoded in the working-repo's config, it will use the same key on both initial clone and subsequent fetches/pushes. – Adam Franco Nov 19 at 16:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.