Phala Cloud Documentation — Private AI on TEE

SSH key methods manage the public keys associated with your Phala Cloud account. These keys are injected into CVMs at boot time, giving you SSH access to your running instances.

list_ssh_keys

GET /user/ssh-keys Lists all SSH keys registered to your account. Parameters: None. Returns: List of SSH key objects. Example:

keys = client.list_ssh_keys()
for key in keys:
    print(key.id, key.name, key.fingerprint)

keys = await client.list_ssh_keys()
for key in keys:
    print(key.id, key.name, key.fingerprint)

create_ssh_key

POST /user/ssh-keys Adds a new SSH public key to your account. Parameters:

Field	Type	Required	Description
`name`	`str`	Yes	Display name for the key
`public_key`	`str`	Yes	SSH public key content

Returns: The created SSH key object. Example: Replace the sample public key with your own key before using it for access.

key = client.create_ssh_key({
    "name": "my-laptop",
    "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4dR/9d26lbwH5ViDEJgWZqaHI6/Mlr8QyTfE6w8ANk docs-example",
})
print(key.id)

key = await client.create_ssh_key({
    "name": "my-laptop",
    "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4dR/9d26lbwH5ViDEJgWZqaHI6/Mlr8QyTfE6w8ANk docs-example",
})
print(key.id)

delete_ssh_key

DELETE /user/ssh-keys/{keyId} Removes an SSH key from your account. Existing CVMs that were provisioned with this key will retain it until they are restarted. Parameters:

Field	Type	Required	Description
`key_id`	`str`	Yes	SSH key identifier

Returns: None Example:

client.delete_ssh_key({"key_id": "key-abc123"})

await client.delete_ssh_key({"key_id": "key-abc123"})

import_github_profile_ssh_keys

POST /user/ssh-keys/github-profile Imports SSH public keys from a GitHub user profile. This fetches the keys listed at https://github.com/{username}.keys and adds them to your account. Parameters:

Field	Type	Required	Description
`github_username`	`str`	Yes	GitHub username to import keys from

Returns: Import response with the number of keys imported. Example:

result = client.import_github_profile_ssh_keys({
    "github_username": "octocat",
})
print(result.model_dump())

result = await client.import_github_profile_ssh_keys({
    "github_username": "octocat",
})

sync_github_ssh_keys

POST /user/ssh-keys/github-sync Syncs SSH keys from your connected GitHub account. This requires that your Phala Cloud account is linked to GitHub via OAuth. Unlike import_github_profile_ssh_keys, this uses your authenticated GitHub connection and keeps keys in sync. Parameters: None. Returns: Sync response with details of added/removed keys. Example:

result = client.sync_github_ssh_keys()
print(result.model_dump())

result = await client.sync_github_ssh_keys()
print(result.model_dump())

CVM SSH keys

get_cvm_ssh_keys({"cvm_id": "my-app"}) reads GET /cvms/{cvmId}/ssh-keys. It returns a CvmSshKeysResponse with keys and restart_required. This is the stored configuration; use get_cvm_user_config for the running VM’s configuration. update_cvm_ssh_keys sends PUT /cvms/{cvmId}/ssh-keys and replaces the configured key set. ssh_key_ids is required: include every selected key you want to retain. An empty list removes all selected keys unless usernames adds members’ resolved keys. Changes take effect at the next power-on, or immediately if apply_now restarts the CVM. This example uses the key created above. Add any other key IDs you want to retain.

result = client.update_cvm_ssh_keys({
    "cvm_id": "my-app",
    "ssh_key_ids": [key.id],
    "apply_now": False,
})
print(result.restart_required)

The async client supports the same calls with await. Both methods also have safe_ variants.

Authentication — account setup
CVM Lifecycle — provisioning CVMs with SSH access

​list_ssh_keys

​create_ssh_key

​delete_ssh_key

​import_github_profile_ssh_keys

​sync_github_ssh_keys

​CVM SSH keys

​Related