Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To deploy a private repository from Coolify, create an ED25519 SSH key pair in Keys & Tokens > Private Keys, add its public key to the repository’s deploy-key or access-key settings, and give Coolify the provider’s SSH clone URL. Keep the private key in Coolify, leave write access disabled, and configure a webhook separately if pushes should trigger deployments.
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
What a Coolify deploy key does
A deploy key is an SSH key pair assigned to repository access. The repository provider stores the public key; Coolify stores and uses the matching private key when it clones or fetches source code. Authentication therefore happens without a username, password, personal access token, or interactive login.
As an Amazon Associate I earn from qualifying purchases.
The permission boundary is deliberately narrow. A deploy key grants one SSH key access to one private repository. It is useful when an application needs source code from a single repository and you do not want to grant a deployment system access to an entire account or organization.
What each half of the key is for
- Private key: saved in Coolify and used by the deployment server during unattended Git operations. It must never be committed to the repository, pasted into application files, or copied to a managed server.
- Public key: copied from Coolify into the repository provider’s deploy-key or access-key form. The provider uses it to recognize the private key presented by Coolify.
Read access versus write access
Normal deployments only need to clone and fetch the repository. When the provider offers a Allow write access or equivalent checkbox, leave it disabled. Enabling it would allow the key to push changes or otherwise modify repository content, increasing the impact of a compromised deployment credential.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why the key cannot require a passphrase
Coolify deployments run without a person present to type a passphrase or approve a second authentication step. Generate or store the key without a passphrase and without an interactive second-factor prompt. A passphrase-protected key that cannot be unlocked automatically will fail during a deployment even though the public key is correctly registered.
What you need before starting
- Administrative access to the Coolify instance where the application will run.
- Permission to edit deploy keys or access keys on the target private repository.
- The repository’s SSH clone URL, such as
[email protected]:owner/repo.gitor[email protected]:group/project.git. - The branch you intend to deploy and the application’s build and runtime settings.
- Outbound DNS and network access from the deployment server to the Git host.
Decide whether you need only manual deployments or automatic deployments after pushes. The deploy key solves repository authentication; it does not, by itself, subscribe Coolify to repository events.
Step 1: Generate an unattended key in Coolify
- Sign in to Coolify and open Keys & Tokens.
- Select Private Keys, then choose New private key.
- Choose Generate ED25519. ED25519 is the preferred option for this workflow.
- Save the key. Coolify saves the generated key immediately.
- Edit the saved key and give it a repository-specific name, for example
billing-api-production. A name that identifies the repository and environment is easier to audit than a generic name such asdeploy-key-1. - Save the edited record and copy the complete value shown as Public key. Copy the entire single-line key, including its key type and any trailing comment.
Use RSA only when the target Git system does not accept ED25519. Whichever algorithm you choose, the private key remains inside Coolify and the public half is the only part you should transfer to the provider.
Check the generated record before continuing
- The key has a clear repository-specific name.
- The key is available in Coolify’s private-key list.
- You copied the public key from this exact record, not from another environment.
- No passphrase or interactive unlock requirement is configured.
Step 2: Add the public key to the repository
Open the settings for the exact private repository that Coolify will clone. Deploy keys are repository-scoped, so adding the key to a different repository, even one in the same organization or group, will not authorize this one.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
GitHub repository
- Open the repository in GitHub.
- Open the repository’s Settings.
- Find the Deploy keys section.
- Choose the option to add a deploy key.
- Enter a descriptive title, such as
Coolify production, and paste the complete public key copied from Coolify. - Leave write access disabled, then save the key.
GitLab project
- Open the project in GitLab.
- Go to Settings > Repository.
- Open Deploy keys.
- Add the key name and paste the complete public key.
- Keep the key read-only and save it.
GitLab’s application integration is documented as available in Coolify v4.3.0 or later, but that is a separate integration choice. A deploy key can still be appropriate when you need access to one project or when an application integration cannot be installed.
Other Git-compatible providers
Look for a repository-level setting named Deploy keys, Access keys, or similar. Add the public key to the repository itself, not to a user’s general SSH-key area unless the provider’s documentation explicitly defines that area as repository access. Confirm that the provider supports ED25519; if it does not, return to Coolify and generate an accepted RSA key instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 3: Use the repository’s SSH clone URL
In the provider’s clone menu, select the SSH option and copy that URL. Typical forms are:
[email protected]:owner/repo.git[email protected]:group/project.git
Paste this SSH URL into Coolify’s repository field. Do not substitute the HTTPS URL in a deploy-key setup. An HTTPS address expects a different authentication mechanism, while the private key you generated is used by the SSH transport.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the URL carefully
- The host is the same Git provider where you registered the public key.
- The owner, group, project, and repository name point to the intended private repository.
- The URL ends with the correct repository suffix, commonly
.git. - There are no extra spaces or line breaks before or after the URL.
The deployment server must also resolve the Git host and reach it over the network. A correctly paired key cannot compensate for blocked DNS, firewall rules, or unavailable outbound connectivity.
Step 4: Create the Coolify application
- Open the relevant Coolify project.
- Select + New.
- Choose Private Repository (with deploy key).
- Select the server that will build and run the application.
- Select the repository-specific private key you generated under Keys & Tokens > Private Keys.
- Paste the repository’s SSH clone URL.
- Choose the branch to deploy.
- Configure the build method, environment variables, ports, health checks, and other application settings required by the project.
- Select Deploy.
During the first deployment, inspect the deployment log rather than assuming that a successful application build proves authentication worked. The log should show a successful clone and checkout of the requested branch or commit before build steps begin.
Recommended Free Tools
What a successful first deployment confirms
- Coolify selected the intended private key.
- The provider accepted the corresponding public key.
- The SSH URL identifies the intended repository.
- The deployment server can reach the Git host.
- The requested branch or commit exists and was checked out.
Enable deployment when code is pushed
Cloning and automatic deployment are separate functions. The SSH key only provides repository access. It does not notify Coolify that a push occurred and does not create a deployment trigger.
Manual webhook setup
- In Coolify, open the application’s webhook or deployment-trigger settings and copy the webhook URL and secret.
- In the repository provider, open the repository’s webhook settings.
- Add a webhook pointing to the Coolify URL and configure the secret exactly as shown in Coolify.
- Select push events, or the provider event that represents the branch updates you want to deploy.
- Save the provider webhook and use its delivery or test facility if available.
- In Coolify, open Advanced > Deployment > Auto deploy and select Deploy on push (webhooks).
- Push a controlled change to the selected branch and confirm that a new Coolify deployment starts.
Keep the webhook secret confidential. A webhook request can reach the endpoint without granting repository read access, so the secret is what lets Coolify distinguish an authorized event from an arbitrary request.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
App-based event integration
A GitHub App or GitLab App can be a better fit when you need to select several repositories, browse repositories from the integration, receive push events through the provider integration, or create pull-request preview workflows. App setup and permissions are broader than a single deploy key, so choose the smallest repository selection that meets the workflow.
Unsupported Git providers
For a provider without a supported Coolify application integration, keep the deploy key for cloning and call Coolify’s deploy webhook from your CI pipeline after required checks pass. This separates the source checkout credential from the system that decides whether a commit is ready to deploy.
Choose the right repository access method
| Method | Best fit | Access and event behavior | Important prerequisite |
|---|---|---|---|
| Deploy key | One private repository, or a provider where an app cannot be installed | Repository-scoped SSH access; webhooks are configured separately | Generate a key, register its public half, and use the SSH clone URL |
| GitHub or GitLab App | Multiple selected repositories, repository browsing, push events, or pull-request previews | Provider integration can provide scoped repository selection and event or webhook support | Install and authorize the app with the required repository scope |
| Public HTTPS repository | Public source that requires no credentials | No deploy key is required | The source must genuinely be public and reachable by HTTPS |
A deploy key is usually the narrowest choice for one private repository. An app is more suitable when the workflow depends on provider-side repository discovery or event integration. A public repository needs neither, but changing a project from private to public changes its source exposure and should be treated as a separate security decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security practices and key rotation
Use one key per repository
Create a separate deploy key for each repository, and preferably distinguish production from non-production environments. If one key is exposed, this limits the number of repositories that must be treated as compromised and makes revocation less disruptive.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Keep the private half in Coolify
Do not commit the private key, place it in an environment variable, attach it to application containers, or copy it into a server account’s ~/.ssh/authorized_keys. Repository authorization and server-login authorization are different systems. Registering a public key with a Git provider does not authorize that key to log in to a server account.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rotate without an avoidable outage
- Generate a replacement key in Coolify and name it clearly.
- Copy the replacement public key to the repository’s deploy-key or access-key settings while the old key remains active.
- Update the Coolify application to select the replacement private key.
- Deploy and verify that the clone and checkout succeed.
- Remove the old public key from the provider and delete or disable the old private key in Coolify.
When a key is exposed, remove its public key from the provider and the corresponding private key from Coolify promptly, then complete the replacement sequence. For a key shared by multiple resources, migrate every dependent application before deleting the old record.
Troubleshooting failed clones and deployments
Clone authentication fails
- Confirm that the public key is attached to the exact repository, not merely to the organization, group, or another project.
- Compare the public key registered at the provider with the public key shown in the Coolify private-key record.
- Check that the application selected the matching private key.
- Replace an HTTPS repository URL with the provider’s SSH clone URL.
- Verify that the key has no passphrase or interactive unlock requirement.
The key works for one repository but not another
This is expected when a deploy key is scoped to one repository. Add a separate key to the second repository, or choose an app integration with an explicitly selected repository scope if the workflow requires access to several projects.
The provider accepts the key but Coolify cannot reach the host
Check DNS resolution and outbound network reachability from the deployment server to the Git host. A valid key is irrelevant if the server cannot establish the SSH connection. Review firewall, egress, proxy, and provider availability conditions from the server’s network.
The repository clones but pushes do not deploy
Repository authentication is working in this case; the missing component is an event trigger. Check that the provider webhook uses the current Coolify URL and secret, that push events are selected, and that Advanced > Deployment > Auto deploy > Deploy on push (webhooks) is enabled. If you use an app integration, verify that the app has access to the repository and that event delivery is enabled.
The key was added to a server account instead of the repository
A key in a server user’s ~/.ssh/authorized_keys controls inbound server login. It does not grant Coolify permission to clone a private repository. Keep the repository public key in the provider’s repository-level deploy-key or access-key setting and select its matching private key in Coolify.
A branch or commit cannot be checked out
After authentication succeeds, confirm that the branch name entered in Coolify exists in the repository and that the requested commit is present. A successful SSH handshake only proves access; it does not make an incorrectly named branch available.
Quick Recap
Production checklist
- ED25519 was generated under Keys & Tokens > Private Keys, unless the provider requires RSA.
- The key has a repository-specific name and no passphrase.
- The complete public key is registered on the intended repository.
- Write access is disabled.
- The Coolify application uses the matching private key.
- The repository field contains the provider’s SSH clone URL.
- The deployment server can resolve and reach the Git host.
- The first deployment log shows a successful clone and checkout of the intended branch or commit.
- Automatic deployment is enabled separately through a webhook, app event integration, or CI-triggered Coolify webhook.
- Rotation ownership and a replacement procedure are documented before the key is needed in an incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
