Platform
Products
Reference
Support
 Search Docs/
Sign Up
 Back to Product Home
 Droplets
Getting Started
Quickstart
Recommended Droplet Setup
Recommended GPU Setup
How-Tos
Create Droplets
Use GPU Droplets
Connect with SSH
Connect with the Droplet Console
Transfer Files with Filezilla
Access Droplet Metadata
Add SSH Keys to Droplets
Create Keys with OpenSSH
Create Keys with PuTTY
Add SSH Keys to Teams
Add Keys to Existing Droplets
Tag Droplets
Track Performance
Provide User Data
Automate Setup with cloud-init
Resize Droplets
Rebuild Droplets
Manage the Droplet Agent
Manage the Kernel
Destroy Droplets
Recover Access or Data
Reference
API Reference
CLI Reference
Concepts
Choosing a Plan
Tips on Downsizing Droplets
Glossary
Details
Features
Pricing
Availability
Images
Limits
Service Level Agreement
Image Deprecation Policy
Droplet Policies
Live Migrations
Support
Product Home > Droplets > How-Tos > Add SSH Keys to Droplets > Add Keys to Existing Droplets
Was this page helpful?

 
Give Feedback
How to Upload an SSH Public Key to an Existing Droplet 
Validated on 28 Aug 2023 • Last edited on 8 May 2024ssh
DigitalOcean Droplets are Linux-based virtual machines (VMs) that run on top of virtualized hardware. Each Droplet you create is a new server you can use, either standalone or as part of a larger, cloud-based infrastructure.

 Note
If you’re struggling with SSH and server management, try our managed products Cloudways and App Platform. Cloudways deploys pre-installed software stacks onto Droplets, and App Platform deploys and scales apps directly from your code repository, along with databases and serverless functions, no SSH or server administration required.
For security reasons, you can’t add or modify the SSH keys on your Droplet using the control panel after you create it, but you have several options to add and modify them via the command line. If you currently have SSH access to the Droplet, you can upload keys in multiple ways:

From your local computer using ssh-copy-id, which is included in many Linux distributions’ OpenSSH packages. We recommend this option if it is available for ease of use.

From your local computer by piping the key into the ~/.ssh/authorized_keys file on the Droplet. This is a good choice if you don’t have ssh-copy-id.

By connecting to your Droplet with SSH and manually adding the public key, which is necessary if you do not have password-based SSH access.

If you currently can’t connect to your Droplet at all, use the Recovery Console to reset the root user password. Once logged in on the console, you can either add your key manually from the console or temporarily enable password authentication to add the key via SSH.

Locally Using ssh-copy-id and Password-Based Access
If you have password-based access to your Droplet, you can copy your SSH key from your local computer to your Droplet using ssh-copy-id.

On your local computer, run ssh-copy-id, substituting your username and your Droplet’s IP address:

ssh-copy-id use_your_username@203.0.113.0
Copy
By default, ssh-copy-id copies the default key, ~/.ssh/id_rsa.pub, to the target server. To specify a different key, use the -i flag, as in ssh-copy-id -i ~/path/to/key.pub use_your_username@203.0.113.0.

Running ssh-copy-id prompts you for the user’s password on the Droplet:

The authenticity of host '203.0.113.0 (203.0.113.0)' can't be established.
ECDSA key fingerprint is fd:fd:d4:f9:EX:AM:PL:E0:e1:55:00:ad:d6:6d:22:fe.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
username@203.0.113.0's password: 
 
Copy
After you enter the password, it confirms the addition of the key:

Number of key(s) added: 1

Now try logging in to the machine, with:   "ssh 'username@203.0.113.0'"
and check to make sure that only the key(s) you wanted were added.
Copy
You can now log in without a password.

Locally by Piping into ssh with Password-Based Access
If you do not have ssh-copy-id on your local computer but you do have password-based SSH access to your Droplet, you can add an SSH key to your Droplet by piping the contents of the key into the ssh command.

The following command makes sure the ~/.ssh directory exists on your Droplet, then pipes the content of the ~/.ssh/id_rsa.pub file on your local computer to the ~/.ssh/authorized_keys file on your Droplet.

Run this command on your local computer, substituting your username and the Droplet’s IP address:

cat ~/.ssh/id_rsa.pub | ssh username@203.0.113.0 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
Copy
Running this command prompts you for the user’s password on the Droplet:

The authenticity of host '203.0.113.0 (203.0.113.0)' can't be established.
ECDSA key fingerprint is fd:fd:d4:f9:EX:AM:PL:E0:e1:55:00:ad:d6:6d:22:fe.
Are you sure you want to continue connecting (yes/no)? yes
username@203.0.113.0's password: 
 
Copy
After you enter the password, it copies your key, and you can log in without a password.

Manually from the Droplet
If you do not have password-based SSH access available, you must add your public key to the remote server manually.

On your local machine, output the contents of your public key.

cat ~/.ssh/id_rsa.pub
Copy
Copy the output, which looks similar to this example:

ssh-rsa EXAMPLEzaC1yc2EAAAADAQABAAACAQCqql6MzstZYh1TmWWv11q5O3pISj2ZFl9HgH1JLknLLx44+tXfJ7mIrKNxOOwxIxvcBF8PXSYvobFYEZjGIVCEAjrUzLiIxbyCoxVyle7Q+bqgZ8SeeM8wzytsY+dVGcBxF6N4JS+zVk5eMcV385gG3Y6ON3EG112n6d+SMXY0OEBIcO6x+PnUSGHrSgpBgX7Ks1r7xqFa7heJLLt2wWwkARptX7udSq05paBhcpB0pHtA1Rfz3K2B+ZVIpSDfki9UVKzT8JUmwW6NNzSgxUfQHGwnW7kj4jp4AT0VZk3ADw497M2G/12N0PPB5CnhHf7ovgy6nL1ikrygTKRFmNZISvAcywB9GVqNAVE+ZHDSCuURNsAInVzgYo9xgJDW8wUw2o8U77+xiFxgI5QSZX3Iq7YLMgeksaO4rBJEa54k8m5wEiEE1nUhLuJ0X/vh2xPff6SQ1BL/zkOhvJCACK6Vb15mDOeCSq54Cr7kvS46itMosi/uS66+PujOO+xt/2FWYepz6ZlN70bRly57Q06J+ZJoc9FfBCbCyYH7U/ASsmY095ywPsBo1XQ9PqhnN1/YOorJ068foQDNVpm146mUpILVxmq41Cj55YKHEazXGsdBIbXWhcrRf4G2fJLRcGUr9q8/lERo9oxRm5JFX6TCmj6kmiFqv+Ow9gI0x8GvaQ== username@203.0.113.0
Copy
Next, connect to your Droplet with SSH.

 Note
If you can’t connect to your Droplet, you can use the Recovery Console to recover access by resetting your Droplet’s root password, and then use ssh to add your keys.
On your Droplet, create the ~/.ssh directory if it does not already exist:

mkdir -p ~/.ssh
Copy
The public keys listed in ~/.ssh/authorized_keys are the ones that you can use to log in to the server as this user, so you need to add the public key you copied into this file.

To do so, run the following command on your Droplet, replacing the example key in quotes (ssh-rsa EXAMPLEzaC1yc2E...GvaQ== username@203.0.113.0) with the key you copied:

echo "ssh-rsa EXAMPLEzaC1yc2E...GvaQ== username@203.0.113.0" >> ~/.ssh/authorized_keys
Copy
Alternatively, you can open the ~/.ssh/authorized_keys file with a terminal-based text editor, like nano, and paste the contents of the key into the file that way.

The ~/.ssh directory and authorized_keys file must have specific restricted permissions (700 for ~/.ssh and 600 for authorized_keys). If they don’t, you cannot log in.

Once the authorized_keys file contains the public key, set the permissions and ownership of the files:

chmod -R go= ~/.ssh
chown -R $USER:$USER ~/.ssh
Copy
You can now log out of your Droplet. The next time you log in, you can do so without a password.

In this article...
Locally Using ssh-copy-id and Password-Based Access
Locally by Piping into ssh with Password-Based Access
Manually from the Droplet
sharethis-white sharing buttonfacebook-white sharing buttontwitter-white sharing buttonlinkedin-white sharing buttonhackernews-white sharing button
Control Panel
Blog
Pricing
Careers
Terms
Privacy
Status
API Docs
Tutorials
Support
Open Chat
Need help? Let's chat!









how to change root ssh key that i use to connect