SSH keys
Generate a key, upload to your account, verify the connection.
Generate
Use Ed25519 — RSA still works but Ed25519 is shorter, faster, and the default on every modern OpenSSH:
ssh-keygen -t ed25519 -C "you@example.com"
Press Enter to accept the default location (~/.ssh/id_ed25519) and set a passphrase if your machine is shared.
Upload
Open Settings → SSH keys → Add key. Paste the contents of:
~/.ssh/id_ed25519.pub
Give the key a name describing the device ("M2 laptop", "work desktop"). Keys list under the same panel; you can revoke individually.
Verify
ssh -T git@src.land
Citadel responds with Hi {slug}! on success. Any other response (timeout, "Permission denied (publickey)") means the key didn't authenticate.
Troubleshooting
- Permission denied (publickey). The agent didn't offer the right key. Run ssh-add ~/.ssh/id_ed25519 to load it, then retry.
- Host key verification failed. Your client doesn't trust the server's host key yet. Accept on first connect; the fingerprint is published on the docs page if you want to verify out-of-band.
- Wrong port. Citadel git-SSH listens on 22. Operator SSH is on 2222 and is a separate surface — never use 2222 for git.