SSH authentication request
An SSH authentication request asks the phone to sign an SSH login attempt with an SSH-key secret. It follows an approved secret-use request but has a separate approval decision. The phone signs the authentication message locally and returns the signature; the private key stays on the phone.
Authentication to sign
Section titled “Authentication to sign”The main card identifies the client and SSH key, followed by the client’s reason when supplied and the authentication details:
| Field | Meaning |
|---|---|
| Remote account | The username in the SSH authentication message. |
| Host key | The server host-key fingerprint and available algorithm, when the authentication method includes a host key. |
| Authentication method | Public-key authentication or host-bound public-key authentication. |
| Signature algorithm | The algorithm used for the requested signature. |
The remote account, method, and available host key come from the authentication message being signed. A hostname is not part of this message.
With Host-bound public-key authentication, the signed message includes the server’s host key, and the app displays its fingerprint. With ordinary Public-key authentication, the message does not include the server’s host key, so the request does not identify the server. A hostname in the command remains information reported by the client.
The card also shows the command that triggered authentication and how much earlier the original command request arrived. When present, Script contents expands to show source captured for that command. The command, reason, and script source provide context but are not independently verified by the phone.
Decide
Section titled “Decide”Allow once creates the requested authentication signature. Deny once refuses it. Applicable approval settings, AI review, or a current temporary SSH-authentication grant may decide the request automatically.
Allow for 4 hours…, when available, approves this request and lets this client request further SSH authentication with the named key for four hours, for any SSH server. It is not restricted to the account, host key, or command currently displayed. It does not grant Git-signing or environment-variable delivery access. See temporary access for eligibility and how to end it.
Agentknock checks that the authentication request belongs to the approved original command and matches its SSH key. If the key was changed or renamed after that command began, start the command again. Changes to applicable approval settings are checked again before signing.
AI review
Section titled “AI review”When Ask AI applies, review includes the remote account, authentication method, signature algorithm, and host-key identity when available, along with the original command context and applicable instructions. The private key is excluded.
The page shows the review result and explanation. Missing original command context or timing information requires a human decision. An unavailable or interrupted review also comes to you, as described in AI review.
Result and technical details
Section titled “Result and technical details”After approval, Authentication signed initially appears with a message that the app is waiting for client confirmation. When confirmation arrives, the page reports that the SSH signature was delivered. The request list labels this Authenticated.
These statuses confirm the signature exchange with the client. They do not confirm that the SSH server accepted the login or that an SSH session completed successfully.
Authentication denied means no signature was created for the request. Invalid requests, client cancellation, expired exchanges, and invalid confirmations show the corresponding explanation. Authentication could not be confirmed means the confirmation was invalid; it does not establish whether the client received a signature.
Expand Technical details for the exact request time, authentication method identifier, signature and available host-key algorithms, client software and library information, client ID, original invocation ID, authentication request ID, and decision and completion times when available.