# Runpod SSH keys: prepare credentials and choose a connection

Prepare a Runpod SSH public key, use the current Connect command and distinguish basic proxied access from full TCP SSH with SCP or SFTP.

Author: Retrivium team
Updated: 2026-11-01
Canonical URL: https://retrivium.ai/journal/runpod-ssh-public-key-setup/
Language: en

For SSH access to Runpod, add the public half of your key in Credentials and use the current Pod's Connect command. Keep the private half on your computer. Basic proxied SSH and full direct TCP SSH have different capabilities, so select the access method before configuring tools around it.

## Prepare the right key material

The uploaded line comes from the public file, typically ending in `.pub`, and may begin with `ssh-ed25519`. A `SHA256:` fingerprint is not the public key itself. Preserve the complete public line rather than copying an abbreviated representation.

Use a separately managed key for a workstation or team member. A clear name and comment make later revocation easier. Never paste the private file into a console field, startup script or support conversation to speed up a normal login setup.

## Choose the connection mode

Basic proxied SSH supports terminal access, but the documentation excludes SCP and SFTP in that mode. If a file client or development tool requires those features, investigate full TCP SSH.

Direct access requires a public IP, an exposed internal SSH port and a running `sshd` inside the environment. An official template may prepare those elements; a custom image must be checked. Installing an SSH client on the laptop does not start a server in the container.

## Use current connection parameters

Copy the command from Connect after the Pod is ready. In direct mode, the external port can differ from internal port `22`. Use the assigned external port with `-p` and the local private-key path with `-i`.

Do not reuse an old Pod command without checking its ID, address and mapped port. Verify server identity through the appropriate process. A host-identity warning after replacement deserves investigation rather than automatic dismissal, even when a newly created environment may explain it.

## Test terminal access before other tools

A researcher who needs SFTP should first verify a normal full-SSH terminal session with their own key, then configure the file client against that same address and external port. If only the basic proxy works, SFTP failure does not automatically mean the key is wrong.

Document the key name, local filename and source of current connection parameters without secrets. At the end, decide whether access should remain. Console credentials and keys already installed inside a running operating environment may require separate revocation steps; check both when transferring responsibility.

## Turn the check into a practical next step

Upload the public half of the key and keep the private half local. Choose an SSH transport that supports the operations the project actually needs.

For the documented details, consult the [primary documentation](https://docs.runpod.io/pods/configuration/use-ssh); [configuration reference](https://docs.runpod.io/pods/configuration/expose-ports). Continue with [runpod ssh connection debug](/journal/runpod-ssh-connection-debug/) and [runpod private port forward](/journal/runpod-private-port-forward/).