Identities & SSH keys

An identity is a reusable credential, a username plus a password, key, certificate or SSH agent, that hosts in the same vault borrow. Rotate a key once in the identity, and every host that uses it follows.

Create an identity

1. Open a vault → Identities → Add identity.
2. Under General, enter a Label and the Username.
3. Under Authentication, choose:
   • Password;
   • Private key — paste the key (-----BEGIN OPENSSH PRIVATE KEY----- …) and its Passphrase, if it has one;
   • Certificate — a private key plus its OpenSSH certificate (ssh-rsa-cert-v01@openssh.com …);
   • SSH agent — the key stays in an agent such as ssh-agent, 1Password or Bitwarden. See SSH agent & agent forwarding.
4. Save.

Then, on a host, choose Use an identity under Credentials and pick it.

Inline credentials or an identity?

	Inline credentials	Identity
Stored	On that host only	Once, in the vault
Changing it	Affects that host	Affects every host that uses it
Best for	A one-off server	Keys shared by many servers

Identity actions

Each identity card's menu has Edit, Share…, Duplicate…, Move to another vault… and Delete. Deleting an identity removes the credentials from every host that uses it.

Share… saves the identity as a zip that works with plain OpenSSH. See Share an identity.

Where keys are kept

Keys and passwords are stored inside the vault, encrypted with the vault's key. They're decrypted only while the vault is unlocked, and they never pass to AI agents.

Access profiles create their own identities, listed separately under Access profile identities.

Tips

• Already have keys in ~/.ssh? Import from ~/.ssh/config copies them into identities and removes duplicates.
• Prefer keys that never leave a hardware token or password manager? Use SSH agent.