Documentation

Install the CLI

Single static binary for Linux, macOS, and Windows. Download links land here with the first tagged release; until then, build from source with go build ./cmd/sshkeys.

Quick start

sshkeys login --server https://sshkeys.io   # device-code sign-in
sshkeys init                                # create + register your identity key
sshkeys publish ~/.ssh/id_ed25519.pub --label work-laptop
sshkeys verify you                          # anyone can check
sshkeys sync you server1                    # install verified keys over ssh
sshkeys revoke work-laptop --reason lost    # permanent, logged
sshkeys refresh --if-needed                 # cron this (see CLI guide)

Guides

The canonical documentation lives with the source code — one source of truth, versioned with the features it describes:

CLI guide	keeping keysets fresh: cron, systemd timers, Windows Task Scheduler, CI-as-signer
Server integration (AKC)	the `AuthorizedKeysCommand` helper: pinning, cache, fail policies, systemd refresh timer
Self-hosting	one binary + SQLite; Docker, environment reference, backups, log witnessing
HTTP API	public endpoints, device flow, publishing, webhooks
Specifications	keyset format, transparency log, threat model

Repository links will appear here when the source is published.

The 60-second server setup

# install helper + dedicated user
install -m 0755 sshkeys-akc /usr/local/bin/
useradd --system --shell /usr/sbin/nologin sshkeys

# pin the identity keys you trust (verify fingerprints out-of-band!)
echo "paul ssh-ed25519 AAAA…" > /etc/sshkeys/pinned

# /etc/sshkeys/config.toml : server, mapping, cache, fail policy
# then:
sshkeys-akc -print-sshd-config >> /etc/ssh/sshd_config
sshd -t && systemctl reload sshd