Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
To deploy a private repository from Coolify, create an ED25519 private key in Keys & Tokens > Private Keys, add its public half to the repository’s Deploy keys or Access keys settings, and use the repository’s SSH clone URL. Then create the Coolify application with + New > Private Repository (with deploy key). The key authenticates cloning; a separate webhook or app event is required for automatic deployment when code is pushed.
What a Coolify deploy key does
A deploy key is an SSH key pair assigned to a repository. The repository host stores the public key and Coolify stores the private key. When Coolify clones or fetches the repository, the Git provider verifies that the two halves match and grants the permissions assigned to that repository key.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe scope is deliberately narrow: one deploy key grants access to one private repository. It is not a user account, an organization-wide credential, or authorization to log in to the Coolify server. A read-only key is normally sufficient because Coolify needs to clone and fetch source code, not push commits or change repository settings.
Authentication and event delivery are separate functions. A working key proves that Coolify can access the repository. It does not tell Coolify that a new commit exists. Deploy-on-push requires a webhook, a GitHub or GitLab App event integration, or a CI job that calls a Coolify deploy webhook.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What you need before creating the key
- Administrator or suitable maintainer access to the Coolify instance so you can create a private key and an application.
- Permission to manage Deploy keys or Access keys on the target repository.
- The exact repository and branch you intend to deploy.
- A deployment server with DNS resolution and outbound network access to the Git host.
- An unattended key. Coolify deployments run without a person present, so the key must not require a passphrase or an interactive second-factor prompt.
Use a separate key for each repository. This limits the impact of exposure and lets you revoke one repository’s credential without interrupting unrelated applications.
Step 1: Generate an ED25519 key in Coolify
- Sign in to Coolify and open Keys & Tokens > Private Keys.
- Select New private key.
- Choose Generate ED25519. ED25519 is the preferred option for this workflow. Choose RSA only if the Git provider or another required system does not accept ED25519.
- Save the generated key. Coolify stores the private half immediately.
- Edit the key and give it a repository-specific name, such as
payments-api-production. A descriptive name matters when several applications use different credentials. - Save the edited record and copy the complete value shown as Public key.
Copy only the public key displayed by Coolify. Do not export, paste, or commit the private half. The private key remains in Coolify and is selected later when the application is created.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDo not add a passphrase after generation or replace the key with one that asks for interactive input. A human can unlock such a key at a terminal, but an unattended deployment cannot reliably do so.
Step 2: Register the public key with the repository
Open the settings for the exact repository you plan to deploy and paste the complete public key, including its key type and trailing comment if Coolify shows one. Do not add the key to a different repository, a personal account’s general SSH-key list, or a server account.
GitHub
Open the repository’s Deploy keys settings, choose the option to add a deploy key, enter a recognizable title, and paste the public key. Leave write access disabled. Coolify only needs to read the repository.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
GitLab
Open the project and go to Settings > Repository > Deploy keys. Add the complete public key, give it a descriptive title, and keep it read-only unless your workflow has a documented requirement for repository writes.
Other Git-compatible providers
Look for a repository-level section named Deploy keys, Access keys, or an equivalent SSH credential page. The key must be attached to the repository itself. If the provider does not offer repository-level SSH keys, use its documented application integration or another supported authentication method instead of assuming a user key has the same scope.
After saving, confirm that the provider displays the key as active and attached to the intended repository. If the provider offers a fingerprint, compare it with the fingerprint or public-key record in Coolify before continuing.
Step 3: Use the SSH clone URL
In the repository’s clone menu, copy its SSH URL. Typical formats are git@github.com:owner/repo.git and git@gitlab.com:group/project.git. Paste that value into Coolify’s repository field.
Do not use the HTTPS URL in the deploy-key flow. An address beginning with https:// expects HTTPS credentials such as a token; it does not select the SSH private key you just created. A syntactically correct SSH URL is not enough by itself: the deployment server must also resolve the Git host and make an outbound connection to it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the URL’s owner, group, repository name, and optional .git suffix exactly as supplied by the provider. A typo can look like an authentication failure because Git may report that it cannot find or access the repository.
Step 4: Create the private-repository application in Coolify
- Open the Coolify project that should contain the application.
- Select + New, then choose Private Repository (with deploy key).
- Select the deployment server.
- Select the repository-specific private key you generated under Keys & Tokens > Private Keys.
- Paste the repository’s SSH clone URL.
- Choose the branch to deploy. If you deploy a tag, commit, or another ref through your project’s configuration, verify that the selected ref is intentional.
- Configure the build, environment variables, domains, health checks, and other application settings required by the project.
- Select Deploy.
Watch the deployment log rather than assuming that a saved form means the setup succeeded. A successful first deployment should show that Coolify authenticated to the Git host, cloned or fetched the repository, and checked out the requested branch or commit before the build starts.
If the source checkout succeeds but the build fails, the deploy key is doing its job. Troubleshoot the build command, runtime, environment variables, or application configuration separately from repository authentication.
How to verify the first deployment
- Confirm that the log identifies the expected repository and branch.
- Check that the checked-out commit is the one you intended to deploy.
- Verify that no step prompts for a passphrase or interactive approval.
- Confirm that the application reaches its health check or configured domain after the build completes.
- Record which Coolify key name is attached to the application so future rotation is unambiguous.
A successful clone is proof of repository access only. It does not prove that push events will trigger a new deployment; that requires the separate trigger configuration described below.
Deploy key versus an App integration
Choose the authentication method according to repository scope and event requirements rather than treating a deploy key as a universal Git integration.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Best fit | Access and event behavior | Important prerequisites |
|---|---|---|---|
| Deploy key | One private repository, or an organization where an app cannot be installed | Repository-scoped SSH access; webhook or another trigger is configured separately | Generate a key in Coolify, register its public half on the repository, and use the SSH URL |
| GitHub or GitLab App | Several selected repositories, repository browsing, push events, or pull-request previews | Can provide scoped repository selection and more direct event or webhook configuration | App installation and provider permissions; GitLab’s documented App integration requires Coolify v4.3.0 or newer |
| Public HTTPS repository | Public source that needs no credentials | No deploy key is required; event automation still needs a supported trigger | A publicly readable repository and a reachable HTTPS clone URL |
A deploy key is often the least-privilege choice when exactly one private repository is involved. An App integration is more convenient when you need to browse or select multiple repositories, receive provider events, or build pull-request preview workflows. Installing an App is not a prerequisite for a single-repository deploy-key deployment.
Enable deploy-on-push separately
The SSH key only provides repository access. To deploy when code is pushed, connect a provider event to Coolify.
Webhook-based setup
- In Coolify, open the application’s webhook or deployment-trigger settings and copy the generated webhook URL and secret.
- In the repository provider, create a webhook that calls that URL.
- Select push events, or the provider event type documented for branch updates. Do not enable unrelated events unless your workflow needs them.
- Save the provider webhook and verify that its test delivery reaches Coolify.
- In Coolify, open Advanced > Deployment > Auto deploy and select Deploy on push (webhooks).
- Push a controlled test commit to the configured branch and inspect the resulting deployment log.
Keep the webhook secret private. If deliveries fail, compare the provider’s recorded response with Coolify’s incoming-webhook log, then check that the application’s branch and auto-deploy setting match the branch receiving the push.
App events
GitHub and GitLab App integrations can handle repository selection and event configuration more directly. They are useful when several repositories share an integration or when pull-request and push events are part of the workflow. The repository still needs to be granted to the App with the provider permissions it requests.
CI-triggered deployment
For a Git provider that cannot deliver a compatible webhook, have the project’s CI pipeline call Coolify’s deploy webhook after required tests and checks pass. This keeps the deploy decision in CI while Coolify remains responsible for building and running the application. Protect the webhook URL and secret as CI secrets, and call it only after the intended branch or commit has been validated.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Security rules for deploy keys
- Keep the private half in Coolify. Never commit it to the repository, paste it into application source, or copy it to a managed server’s home directory.
- Use read-only access. Leave provider write access disabled unless a clearly documented automation requires writes.
- Use one key per repository. Shared keys increase the number of systems affected by one exposure and make revocation harder.
- Name keys by repository and environment. A name such as
catalog-stagingis safer to operate than a generic label such asdeploy-key-1. - Limit who can edit keys and webhooks. Repository key administration can grant source access even when application permissions are otherwise restricted.
- Review access periodically. Remove keys for retired applications and repositories, and check webhook destinations and secrets when ownership changes.
Rotate a key without an avoidable outage
Rotation is safest when the replacement is active before the old credential is revoked.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Generate a new ED25519 private key in Keys & Tokens > Private Keys and give it a new, date- or environment-specific name.
- Copy the replacement public key into the repository’s Deploy keys or Access keys settings while the old key remains active.
- Update the Coolify application to select the replacement private key.
- Run a deployment and confirm a successful clone and checkout.
- After every dependent application has migrated, remove the old public key from the provider and delete or disable the old private key in Coolify.
If the key may have been exposed, do not wait for the normal rotation window. Remove its public key from the provider, remove the corresponding private key from Coolify, generate a replacement, register it, update the application, and redeploy. For a key shared by multiple resources, migrate each resource before deleting the old credential.
Troubleshoot the common failures
“Permission denied” or clone authentication fails
- Check that the public key is attached to the exact repository, not merely to the provider account.
- Confirm that the private key selected in Coolify is the pair matching that public key.
- Verify that the repository field contains the SSH URL, not an HTTPS URL.
- Make sure the repository still exists and that the selected branch is accessible.
- Check the deployment server’s DNS resolution and outbound connectivity to the Git host.
The key works for the repository but not for a server account
Repository authorization and server login authorization are different. Adding a public key to a Git provider’s Deploy keys page does not add it to a server user’s ~/.ssh/authorized_keys. A key intended for Git access will not automatically authorize shell access to the deployment server, and a server login key will not automatically grant repository access.
Cloning succeeds but pushes do not deploy
This indicates that repository authentication is working while event delivery is missing or misconfigured. Check that a webhook or App event integration exists, that push events are enabled, that the webhook secret matches, and that Advanced > Deployment > Auto deploy > Deploy on push (webhooks) is enabled for the application. Also verify that the push targets the branch configured for deployment.
A provider other than GitHub or GitLab cannot be reached
Test DNS resolution and outbound network reachability from the deployment server to the provider’s Git host. Firewalls, egress restrictions, private DNS zones, and nonstandard SSH endpoints can prevent a correct key from being used at all. Confirm the provider’s required hostname and SSH port, then use the exact SSH clone URL it supplies.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The provider rejects ED25519
Some legacy systems do not accept ED25519 keys. Return to Coolify’s private-key creation flow and generate an RSA key only for that compatibility requirement. Keep the same repository-level, read-only scope and unattended-use rules.
Quick Recap
Operational checklist
- Key generated in Coolify under Keys & Tokens > Private Keys.
- ED25519 selected unless the target provider requires RSA.
- No passphrase or interactive prompt on the key.
- Repository-specific name assigned.
- Complete public key registered on the exact repository.
- Write access left disabled.
- SSH clone URL used in Coolify.
- Correct server, private key, branch, and build settings selected under + New > Private Repository (with deploy key).
- Deployment log confirms clone and checkout.
- Webhook, App event, or CI trigger configured separately for push deployments.
- Replacement procedure documented before the key needs rotation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
