ssh-add

Add, inspect and remove identities in an existing agent.

Before you run

An agent must be reachable via SSH_AUTH_SOCK. ssh-add -l reporting no identities is different from being unable to connect to the agent. -t sets the loaded identity’s lifetime; it does not delete or expire the key file. Removing an identity from the agent does not remove server authorization or a saved keychain item.

Examples

Load a private key for one hour; enter its passphrase if requested.

ssh-add -t 1h ~/.ssh/id_ed25519

List fingerprints of identities currently loaded in the agent.

ssh-add -l

Remove this identity from the agent without deleting its file.

ssh-add -d ~/.ssh/id_ed25519

Options and examples

identity_fileCommon

Add a private key to the agent, prompting for its passphrase when needed.

Example

ssh-add ~/.ssh/id_ed25519

-l / -LCommon

List fingerprints or public keys currently held by the agent.

Example

ssh-add -l

-t lifeCommon

Limit how long the identity stays in the agent; this does not expire or revoke the key itself.

Example

ssh-add -t 1h ~/.ssh/id_ed25519

-d identity_fileCommon

Remove one identity from the agent; this does not revoke it on the server.

Example

ssh-add -d ~/.ssh/id_ed25519

-D

Remove all identities from the current agent, without deleting key files.

Example

ssh-add -D

-c

Require confirmation before an added identity is used; an appropriate confirmation program is required.

Example

ssh-add -c ~/.ssh/id_ed25519

-x / -X

Lock or unlock the agent interactively.

Example

ssh-add -x

-T public_key

Test whether the agent can use the corresponding private key.

Example

ssh-add -T ~/.ssh/id_ed25519.pub

Authoritative references

Reviewed October 27, 2026