In Coolify, open Keys & Tokens → Private Keys, choose New private key, and either generate an ED25519 key or import an existing private key. Coolify uses the private half; you must place the matching public key on the server account or in the Git provider’s deploy-key settings before testing the connection.
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
What adding an SSH key to Coolify actually does
Coolify does not authorize a server or repository merely because a private key has been uploaded. The stored private key is one half of an SSH key pair. The corresponding public key must be authorized at the destination:
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- For a server connection, the public key belongs in the target account’s
~/.ssh/authorized_keysfile. - For a private Git repository, the public key belongs in that repository’s deploy-key or access-key settings.
These are separate trust relationships. A key authorized in a server user’s authorized_keys file permits server login, but it does not grant repository access. A repository deploy key permits Git operations for that repository, but it does not permit logging in to the server. Purpose-specific keys make rotation and revocation independent.
Coolify must be able to use the private key without waiting for a person to answer a prompt. Do not protect the key with a passphrase or a second-factor prompt. If the destination only accepts RSA, use RSA; otherwise ED25519 is the default choice.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you begin
Have the following information ready for the connection you are configuring:
- The destination server’s IP address or domain name, SSH port, and login user.
- Permission to edit that account’s
~/.ssh/authorized_keys, or an existing trusted session through which you can do so. - For a private repository, permission to add a deploy key and the repository’s SSH clone URL.
- Coolify administrator or owner access. Only team administrators and owners can create, change, or delete private keys.
Decide whether the key is for server login, one repository, or a narrowly defined operational purpose. A shared key can work, but separate keys limit the impact of a compromise and let you rotate one integration without interrupting another.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Create or import the private key in Coolify
- Sign in to Coolify and open Keys & Tokens → Private Keys.
- Select New private key.
- Choose Generate ED25519 for a new key, or choose the import option if you already have a key pair.
- Do not enter a passphrase. Coolify needs non-interactive access for server checks, deployments, and repository operations.
- Save the key.
- Open the saved key’s edit screen and give it a purpose-specific name, such as
production-server-2026ororders-repository-readonly. A descriptive name is especially useful when several keys have similar destinations. - Copy the complete value shown as Public key. Keep it intact, including its key type, encoded key body, and trailing comment if one is present. The public key must be copied as one line.
When importing an existing key, import the private half into Coolify and use the matching public half for authorization. A public key from a different pair will not validate, even if it uses the same algorithm.
ED25519 or RSA?
| Choice | Use it when | Important condition |
|---|---|---|
| ED25519 | You are generating a new key and the destination supports it. | This is Coolify’s default generation option. |
| RSA | The target operating system, SSH implementation, or Git service does not accept ED25519. | Use a key size and format accepted by that target; no universal RSA size requirement is specified. |
| Existing key | You must preserve an established integration or are migrating an already-authorized pair. | Verify that the public key you install is the exact match for the private key imported into Coolify. |
Authorize the key for a Coolify server connection
The following procedure installs the copied public key for the account Coolify will use. Perform it from a trusted terminal while you still have a working login. Do not remove the key that supports your current session until Coolify has passed validation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Connect to the destination account, for example
ssh root@<server-ip>orssh -p <ssh-port> root@<server-ip>. Replace the account, address, and port with your actual values. - Create the SSH directory if necessary:
mkdir -p ~/.ssh. - Set the directory permission:
chmod 700 ~/.ssh. - Open the authorization file:
nano ~/.ssh/authorized_keys. - Paste the complete public key copied from Coolify on its own line. Do not wrap it across lines and do not overwrite other keys that are still needed.
- Save the file and set its permission to
chmod 600 ~/.ssh/authorized_keys.
Check the account carefully before saving. Installing the key for a different user, such as an administrative account when Coolify is configured to use an application user, produces an authentication failure even though the key itself is valid.
Add the server in Coolify and validate it
- Open Servers in Coolify.
- Select New server → IP address or domain.
- Enter the server host, SSH port, and user that owns the authorized key.
- Select the matching Private key from the key list.
- Select Continue, then choose Validate connection.
Validation does more than test whether TCP port 22 is reachable. Coolify attempts SSH authentication, checks the operating system and required tools, installs or verifies Docker Engine and Compose, records server information, and starts the proxy. A successful SSH login with an account that lacks the required permissions or tools can therefore still fail later in validation.
After validation succeeds, keep the server’s selected private key associated with that server. Changing the selection without first authorizing the replacement public key will interrupt the connection.
Deploy a private Git repository with a deploy key
A deploy key is repository-scoped: one SSH key grants access to one private repository. This is different from a server-login key and should be managed as a separate authorization when you want independent rotation or revocation.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- In Coolify, open the saved private key and copy its complete Public key.
- Open the repository provider’s settings for the specific private repository.
- Add the public key under the provider’s deploy-key or access-key section.
- Keep write access disabled unless your deployment process genuinely requires the repository to be modified. A read-only deploy key is the safer default.
- In Coolify, create or edit the application and choose Private Repository (with deploy key).
- Select the server on which the application will run.
- Select the stored private key that matches the public key registered with the repository.
- Enter the repository’s SSH clone URL, for example
[email protected]:owner/repo.git. Do not paste the HTTPS clone URL. - Save the application configuration and run the available connection or deployment check.
The deployment server must be able to resolve and reach the Git host. Coolify documents SSH deploy-key deployments for Forgejo, Gogs, and self-hosted Git-compatible servers as well as hosted providers; network reachability from the deployment server remains a prerequisite.
Server key and repository key are not interchangeable
| Authorization location | What it permits | What it does not permit |
|---|---|---|
Server user’s ~/.ssh/authorized_keys |
SSH login to that server account. | Cloning a private repository unless the Git provider separately trusts the key. |
| Repository deploy-key settings | SSH access to that one repository, subject to the provider’s read/write setting. | Logging in to the deployment server. |
You can technically reuse a key where both destinations accept it, but that couples two security boundaries. Separate keys allow you to revoke repository access without disconnecting server management, or replace a server key without changing repository settings.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose a setup that fits the access scope
| Setup | Scope | Rotation impact | Typical use |
|---|---|---|---|
| One server-login key per server | One or more server accounts, depending on where its public half is installed. | Replacing it requires updating every account that trusts it. | Coolify-to-server management. |
| One deploy key per repository | One private repository. | Replacing it affects only that repository and the Coolify application using it. | Read-only source retrieval. |
| Shared key for servers and repositories | Every destination where the public half is installed. | A single compromise or rotation affects all destinations. | Only when operational simplicity outweighs isolation. |
| Purpose-specific keys | A narrowly defined server, repository, or integration. | Each key can be replaced and revoked independently. | Preferred for production and teams with regular access reviews. |
The SSH key only supplies repository authentication. It does not determine whether deployment starts manually, through a provider webhook, or from an external workflow; those triggers are configured separately.
Troubleshoot an invalid or failed SSH key
Work through the failure in the same order that Coolify uses the connection: destination details, network access, account authorization, key pairing, and then server capabilities.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Coolify cannot reach the host
- Confirm that the host is the intended IP address or domain.
- Confirm the SSH port. A non-default port must be entered in Coolify and used in your terminal test.
- Check firewalls, security groups, and network ACLs between the Coolify instance and the destination.
- For a self-hosted Git service, verify that the deployment server can resolve the Git hostname and reach its SSH service.
SSH reaches the host but authentication fails
- Confirm that the Coolify server entry uses the same user for whom you edited
~/.ssh/authorized_keys. - Compare the public key in the account’s file with the public key shown in Coolify. It must be the matching public half of the imported private key.
- Ensure the public key is complete and occupies one line. Truncation, accidental line wrapping, or pasted extra characters invalidate it.
- Check the required permissions:
~/.sshshould be mode700andauthorized_keysshould be mode600. - Make sure the key was not added to a different account or a different server.
Do not delete the previously working key while diagnosing the replacement. Keeping the existing session available prevents a failed test from locking you out.
The key prompts for a passphrase
Coolify cannot stop for an interactive passphrase or second-factor response. Create or import a key without a passphrase and authorize its public half at the destination. Protect access to Coolify and its encrypted credential storage instead of relying on an interactive prompt that the deployment service cannot answer.
SSH succeeds but validation still fails
Validation also checks the operating system and tools, verifies or installs Docker Engine and Compose, records server details, and starts the proxy. Review the validation output for missing permissions, unsupported system components, or blocked access to the package and container services. Correct those server conditions and validate again; changing the SSH key will not fix a post-authentication tool failure.
Repository cloning fails after server validation
- Confirm that the application uses Private Repository (with deploy key).
- Confirm that the selected private key is the one whose public half is registered with that repository.
- Use the provider’s SSH clone URL, not its HTTPS URL.
- Check that the deploy key was added to the intended repository and that its read permission remains enabled.
- Check DNS and outbound SSH connectivity from the deployment server to the Git host.
Rotate or delete a Coolify private key safely
Do not replace a shared private-key value in place while active servers or applications still depend on it. Create a replacement and migrate consumers in a controlled order.
- Create a new ED25519 key in Keys & Tokens → Private Keys, or import a replacement key without a passphrase.
- Give it a purpose-specific name so the old and new entries cannot be confused.
- Copy the replacement public key to every required server account and repository deploy-key setting.
- For repository keys, preserve the intended read-only setting.
- Change each Coolify server entry and application to use the replacement private key.
- Validate every affected server and perform at least one representative deployment for each application or repository integration.
- Remove the old public key from servers and repositories only after those checks succeed.
- Delete the old private-key entry in Coolify after confirming that no consumer still references it.
Coolify marks a key as unused only when no server, application, GitHub App, or GitLab App references it. The interface prevents safe deletion while dependencies remain, so an apparently obsolete key may require you to update or remove a lingering reference first.
How Coolify protects stored keys
Coolify encrypts supported credentials, including SSH private keys, in its database. Self-hosted installations also write keys to protected SSH storage. Treat the Coolify database, /data/coolify/source/.env, /data/coolify/ssh/keys/, and backups as privileged recovery material. Anyone who can recover those assets may be able to recover deployment credentials.
- Restrict Coolify administrator and owner access to people who manage infrastructure.
- Protect database and filesystem backups with the same care as the live instance.
- Use separate keys for unrelated servers and repositories where independent revocation matters.
- Keep deploy keys read-only unless a documented workflow requires write access.
- Record the owner and intended destination of each key in its Coolify name, without putting the private key itself in notes or tickets.
Using the Coolify CLI and self-hosted Git services
The Coolify CLI supports creating an application from a private repository with coolify app create deploy-key. The operation requires the private-key UUID, the Git branch, and the repository’s SSH URL. Supply the UUID of the key stored in Coolify, not the public-key text and not a local file path. The same authorization rules apply: the corresponding public key must already be registered with the repository, and the deployment server must be able to reach the Git host.
For Forgejo, Gogs, and other self-hosted Git-compatible services, configure the provider-side deploy key and use the provider’s SSH clone address. Name resolution and outbound connectivity are evaluated from the server where Coolify performs the deployment, not necessarily from your workstation.
Quick Recap
Completion checklist
- The key appears under Keys & Tokens → Private Keys and has a clear purpose-specific name.
- The key has no passphrase or interactive second-factor requirement.
- The public half was installed at the exact server account or repository that needs it.
- For a server, the host, port, user, and matching private key are configured under Servers.
- Validate connection completes, including the operating-system, tool, Docker, Compose, and proxy checks.
- For a private repository, the application uses Private Repository (with deploy key) and an SSH clone URL.
- Repository write access is disabled unless required.
- Old keys remain in place until replacement validation and a deployment test succeed, then are removed from destinations before deletion in Coolify.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
