# SSH keypairs

For repositories hosted on platforms where AM can't use a GitHub token (GitLab,
Bitbucket, self-hosted git), you can use an **SSH keypair** generated by the
panel. The panel holds the private key; you whitelist the public key in your git
provider.

## Generate a keypair

1. Go to **Settings → SSH Keys**.
2. Click **+ Generate key**, optionally give it a name (e.g. `gitlab-dev`).
3. The panel creates an Ed25519 keypair. The **public key** is shown immediately
   — copy it to your git provider's SSH key settings.
4. The private key stays on the panel and is deployed to your workers
   automatically.

You can also **import an existing keypair** by pasting its private key PEM.

## Use a keypair with a repo

Once a keypair exists, it appears in the repo settings drawer under **SSH key**.
Select it for any repo that needs SSH-based clone access. The worker will use
this keypair during runs instead of the default GitHub token.

## Manage keypairs

- **Delete** a keypair from Settings → SSH Keys. If it's in use by any repo,
  those repos will fall back to the GitHub token for future runs.
- Keypairs are per-account. Each user manages their own set.
- The private key is never shown in run logs or agent messages.

## Related

- [Connect GitHub](/docs/connect-github) — default GitHub token auth
- [Add a repository](/docs/add-repository)
- [Security & data](/docs/security)