SSH key API

SSH key API

Manage public-key registry entries without implying guest-side revocation.

SSH-key resources store public keys selected during guest initialization. Changing the registry affects future provisioning; it does not rewrite keys already installed inside existing guests.

POST/organizations/{organization_id}/projects/{project_id}/ssh-keys
Scope
droplets:write
Auth
Bearer API key

Registers a public provisioning key.

Send name and public_key. The accepted key must parse as a supported public SSH key. Private-key material, malformed encodings, and unsupported algorithms return 422 invalid_public_key without creating a registry entry.

To register a public provisioning key, send this body:

JSON
{
  "name": "platform-admin",
  "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAiYQsAuvpHKkyL6v6F/YUXgemm25L1od8ReVaO6rIWE platform-admin"
}

The example illustrates field shape; submit a public key generated for the intended operator. Returns 201 with ID, name, algorithm, fingerprint, revision, and creation time. A fingerprint already registered in the project returns 409 key_already_registered and the visible existing ID.

Read and rename

GET/organizations/{organization_id}/projects/{project_id}/ssh-keys
Scope
droplets:read
Auth
Bearer API key

Lists public-key entries visible in this project. Requires droplets:read.

GET/organizations/{organization_id}/projects/{project_id}/ssh-keys/{key_id}
Scope
droplets:read
Auth
Bearer API key

Returns name, fingerprint, algorithm, revision, and public material. There is no stored private key to reveal. Requires droplets:read.

PATCH/organizations/{organization_id}/projects/{project_id}/ssh-keys/{key_id}
Scope
droplets:write
Auth
Bearer API key

Renames a key without changing its public material.

Accepts name only and requires If-Match. Key material is immutable. Register a replacement as a new ID instead of changing the meaning of an ID already recorded in template and deployment history.

Rotate a deployed key

Register the new key and update the relevant template revision. For running guests, apply the replacement through authorized configuration management or a supported guest-agent procedure. Verify a new login before removing the old key from the guest account.

Deleting the old registry entry does not revoke an authenticated SSH session or remove its authorized-key line inside a guest. Those actions must use the guest's own access-management procedure.

Delete

DELETE/organizations/{organization_id}/projects/{project_id}/ssh-keys/{key_id}
Scope
droplets:write
Auth
Bearer API key

Deletes a key from the provisioning registry when references permit removal.

Requires the key's current ETag. A fixed template reference can return 409 key_in_use until a replacement revision is published or the reference is retired. Guest creation history retains the original key ID after registry removal.

A cloned disk can still contain old authorized keys and SSH host keys regardless of what the registry lists. Review cloning identity and Guest access when moving a guest to another operational owner.