ssh-agent

Keep signing identities available to SSH clients through an agent.

Before you run

macOS may already provide an agent: try ssh-add -l first. These eval examples are for zsh/bash, not PowerShell. Only start a separate agent when needed, and stop only the agent you started. The environment applies to the current shell and child processes. Do not enable agent forwarding (-A) casually: a compromised remote host can use a forwarded agent to authenticate while available.

Examples

Start a separate agent and set its environment in the current shell.

eval "$(ssh-agent -s)"

Stop the separate agent started above and clear its shell variables.

eval "$(ssh-agent -k)"

Options and examples

-sCommon

Print Bourne-compatible shell commands to set agent environment variables; the example is for sh-compatible shells.

Example

eval "$(ssh-agent -s)"

-c

Print C-shell commands instead of Bourne-shell commands.

Example

ssh-agent -c

-kCommon

Print commands to stop the agent identified by the current environment. Stop only an agent you started.

Example

eval "$(ssh-agent -k)"

-t life

Set the default lifetime for identities added to this agent, unless ssh-add overrides it.

Example

ssh-agent -t 1h

-a bind_address

Bind the agent to the specified Unix socket path; protect access to that socket.

Example

ssh-agent -a /tmp/example-ssh-agent.sock

-D

Run the agent in the foreground; useful for supervision.

Example

ssh-agent -D

Authoritative references

Reviewed October 27, 2026