Create an SSH Key on Mac: Terminal, ed25519, and Keychain Integration

Create an SSH key on Mac with the built-in OpenSSH client. The right command is ssh-keygen -t ed25519 -C "alice@macbook". The right Keychain integration is ssh-add --apple-use-keychain to persist the passphrase. The team that has this set up has SSH that works across reboots without retyping the passphrase.

Table of contents

• The right command
• Adding the key to the Keychain
• The right ~/.ssh/config
• Copying the public key to a server
• FAQ

The right command

Open Terminal and run:

ssh-keygen -t ed25519 -C "alice@macbook"

The command prompts for a file location and passphrase. The right answer is to set a passphrase and to use the default file location.

Adding the key to the Keychain

The right way to avoid retyping the passphrase:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

The right answer is that the passphrase is now stored in the macOS Keychain and persists across reboots.

The right ~/.ssh/config

The right way to set up the SSH client:

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Copying the public key to a server

The right way is ssh-copy-id alice@server. Or copy to clipboard:

pbcopy < ~/.ssh/id_ed25519.pub

And paste into ~/.ssh/authorized_keys on the server.

FAQ

What is the difference between —apple-use-keychain and -K?

--apple-use-keychain is the modern name. -K is the legacy alias.

Why does my passphrase not persist after a reboot?

Add UseKeychain yes to ~/.ssh/config.

Can I have multiple keys for different services?

Yes. Generate one per service and use IdentityFile per host in ~/.ssh/config.

What if pbcopy does not work?

Use cat ~/.ssh/id_ed25519.pub and copy manually.

Why does ssh-copy-id not work?

Install via Homebrew: brew install ssh-copy-id.

How do I see the key fingerprint?

ssh-keygen -l -f ~/.ssh/id_ed25519.

What is the right comment?

Your email or a description of the machine. The right answer is to make it identifiable.

Can I use a YubiKey on Mac?

Yes, with ssh-keygen -t ed25519-sk -O resident. The right answer is to use a hardware key for high-value use cases.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references:

• Create Ssh Key In Windows
• How To Create Node Backend
• Ssh Create Key Windows