With ssh -i <private key filename> you can instruct ssh to use an extra private key to try authentication.

The documentation is not clear on how to explicitly use only that key.


2 Answers 2


You can use the IdentitiesOnly option:

ssh -o "IdentitiesOnly=yes" -i <private key filename> <hostname>

  • 17
    actually 'IdentitiesOnly' disables prompting ssh-agent, but still offers defaults and ssh_config'd keys.
    – rogerovo
    Jun 25, 2014 at 6:55
  • 4
    The important thing for me was that it does not look in e.g. my ~/.ssh directory for keys to try. Jun 25, 2014 at 8:50
  • Thanks! I needed the -o "IdentitiesOnly=yes" bit to prevent ssh-agent from overriding the private key specified. Mar 19, 2019 at 20:10
  • 2
    This is super handy for determining which key works with a given host when you have keys cached in ssh-agent. The only way I could figure it out without this flag was to use strace to dump the IO, which was pretty tedious.
    – Wil
    Jun 5, 2019 at 16:11
  • 3
    You can also add -v to your ssh command to know which key is being used (add more v if one is not enough)
    – 2072
    Apr 7, 2021 at 8:43

An alternative could be to generate a pair of keys using


and create a special configuration for the specified host and corresponding private key

Edit ~/.ssh/config

Host handy_server
    HostName x.y.z.w
    IdentityFile ~/.ssh/handy.pub
    IdentitiesOnly yes
    User userk
    Port 22
  • 7
    I believe the IdentityFile should point to the private key ~/.ssh/handy Jul 21, 2021 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.