Generate an SSH Key on macOS: Terminal, Keychain, and the Right Config

Generate an SSH key on macOS with the built-in OpenSSH client. The right command is ssh-keygen -t ed25519. The right Keychain integration is ssh-add --apple-use-keychain ~/.ssh/id_ed25519 to store the passphrase in the macOS Keychain. The team that has this set up has SSH that works across reboots without retyping the passphrase.

Table of contents

• The right command
• Adding the key to the Keychain
• The right ~/.ssh/config
• Copying the public key to a server
• Connecting to GitHub
• FAQ

The right command

Open Terminal and run:

ssh-keygen -t ed25519 -C "alice@macbook"

The command prompts for a file location (default ~/.ssh/id_ed25519) and a passphrase. The right answer is to set a passphrase and to use the default file location.

Adding the key to the Keychain

The right way to avoid retyping the passphrase on every SSH connection is to add the key to the macOS Keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

You will be prompted for the passphrase once. After that, every SSH connection that uses this key succeeds without a prompt, and the passphrase persists across reboots.

The right ~/.ssh/config

The right way to set up the SSH client is ~/.ssh/config. The right defaults:

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

The UseKeychain yes line is the macOS-specific key — it tells the SSH client to use the macOS Keychain for storing passphrases. The right answer is to include it on macOS; the wrong answer is to include it on Linux (it is not supported).

Copying the public key to a server

The right way is ssh-copy-id alice@server:

ssh-copy-id [email protected]

This prompts for the server password one last time and appends the public key to ~/.ssh/authorized_keys on the server.

Connecting to GitHub

The right way is to add the public key to GitHub:

cat ~/.ssh/id_ed25519.pub | pbcopy

Then go to GitHub → Settings → SSH and GPG keys → New SSH key, paste, and save. The right answer is to give the key a descriptive title (e.g., MacBook Pro — Work).

FAQ

What is the difference between —apple-use-keychain and -K?

--apple-use-keychain is the modern name. -K is the legacy alias. The right answer is to use the new name.

Why does my passphrase not persist after a reboot?

The right answer is to add UseKeychain yes to ~/.ssh/config and AddKeysToAgent yes. The wrong answer is to keep re-adding the key on every reboot.

Can I have multiple keys for different services?

Yes. Generate one per service and use IdentityFile per host in ~/.ssh/config.

What if pbcopy does not work?

Use cat ~/.ssh/id_ed25519.pub and copy manually.

Why does ssh-copy-id not work?

On older macOS, ssh-copy-id may not be installed. The right answer is to install it via Homebrew (brew install ssh-copy-id) or to copy the key manually.

How do I see the key fingerprint?

ssh-keygen -l -f ~/.ssh/id_ed25519. The right answer is to compare the fingerprint against the value on the server side.

What if the key is too old?

Generate a new one. The right answer is to rotate keys annually.

What is the right comment?

Your email or a description of the machine. The right answer is to make it identifiable when you see it in authorized_keys on a server.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references:

• Generate A Ssh Key Windows
• Macos Generate Ssh Key
• Windows Generate Ssh Key