iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Permission denied (publickey) means the SSH server rejected public-key authentication; it does not prove your key file is corrupt. First confirm the host and login name, then use verbose output to see whether SSH found and offered the key you intended. If it was offered, compare its public key with the one authorized for that account or server before changing anything.
Start with the host and login name
Make sure you are connecting to the intended machine and using the login account that has permission to access it. SSH usernames are not interchangeable across services.
For Git operations on GitHub, the SSH username is git, regardless of your GitHub profile name. Test with:
Recommended Free Tools
ssh -vT git@github.comFor GitLab, substitute your instance’s hostname in its documented test command:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -Tvvv git@gitlab.example.comOn a regular server, use the operating-system account name authorized on that server. Git hosting instructions do not establish the login name or key configuration for an unrelated SSH server.
Use verbose output to identify the failure
Verbose SSH output shows which identity files the client checks and whether it offers a key. Look for lines referring to identity files, an identity being offered, and the server’s response. This separates two different situations: the client did not find or offer the intended key, or the server rejected a key that was offered.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| What the output suggests | What to check next |
|---|---|
| No identity file is found, or no key is offered | Check the key’s path and filename, then inspect the agent. If the key is not at a default path, select it explicitly with -i. |
| A key is offered but authentication is rejected | Compare that key’s public half or fingerprint with the key authorized for the target account or server. Confirm the host, username, and supported key type. |
| A GitHub Git operation uses your profile name as the SSH username | Use git as the username for the GitHub SSH connection. |
| GitLab works in one terminal session but not another | Check whether the agent in the failing session has the key loaded, and verify local permissions. |
| SSH authentication succeeds but the repository action is denied | Check repository or deploy-key authorization; successful SSH authentication alone does not grant access to every repository. |
Check the agent and select the intended key
If your key is not offered, inspect the identities loaded in the current SSH agent. GitHub’s documented check is:
ssh-add -l -E sha256If the intended identity is missing, load it with ssh-add and the private key’s path, or tell SSH which key to use for a single connection:
ssh -i ~/.ssh/KEY-FILE -T git@github.comReplace KEY-FILE with the actual private-key filename. For GitLab or a regular server, use the corresponding host and login name instead of the GitHub example. A key loaded in one terminal or session may not be available in another, so check the agent from the session where the connection fails.
Verify that the offered key is authorized
The client authenticates with a private key, while the destination must recognize its matching public key. Compare the fingerprint or public key for the identity SSH offered with the key registered to the relevant hosting account. For a self-managed server, the administrator may need to check the account’s authorized-key configuration instead.
If the offered key matches a registered key, confirm that the hosting account or server account has the required access. On Git hosting, repository permissions and deploy-key scope are separate from the initial SSH authentication. For a regular server, ask its administrator to verify account authorization and server-side SSH policy.
Check local key and directory permissions
Local permissions can prevent SSH from using a private key. GitLab’s documented guidance specifies mode 600 for the private key and 700 for the .ssh directory. On a Unix-like system, check or set them with:
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
chmod 600 ~/.ssh/KEY-FILE
chmod 700 ~/.sshUse the actual private-key filename. These are local filesystem permissions; they do not register the key with a hosting account or authorize it on a remote server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If the correct key is offered and still rejected
Once the intended key is confirmed as offered and authorized, investigate causes beyond key selection:
- Key type support: Confirm the destination accepts the key type. GitLab notes that ED25519 may be incompatible with some FIPS systems.
- Account or repository rights: Verify that the account is permitted to access the requested repository or server resource.
- Server policy: For a regular SSH server or self-managed service, have an administrator check account authorization and server-side SSH settings.
- Host-specific configuration: Review SSH configuration for settings that select a different user, identity file, or agent behavior for that host.
Do not routinely use sudo to work around a GitHub key failure. GitHub warns that a key created without elevated privileges may not be the key used by sudo git push; running Git with elevated privileges can therefore change which identity is available.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Distinguish authentication from other SSH errors
Permission denied (publickey) is a public-key authentication rejection. It is different from a host-key verification failure, DNS resolution problem, blocked network connection, or a repository authorization error that occurs after SSH authentication. GitHub’s troubleshooting index treats these as distinct issues: GitHub SSH troubleshooting.
GitHub explains, “A "Permission denied" error means that the server rejected your connection.” Its guidance and the git username rule apply to GitHub connections, while GitLab’s diagnostics and permission guidance apply to GitLab and its documented self-managed cases. Sources: GitHub Docs: Error: Permission denied (publickey) and GitLab Docs: Troubleshooting SSH.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
