SSH key editor
The same key controls appear when creating an SSH secret and when replacing an existing key. A secret holds one private key. Agentknock stores it encrypted and performs SSH authentication and Git signing on the phone; clients receive its public key and operation results.
Generate a new key
Section titled “Generate a new key”Generate new key creates key material on the phone. Choose an algorithm:
| Algorithm | Behavior |
|---|---|
| Ed25519 | The default for new secrets and the app’s recommended choice for new keys. |
| RSA | Generates a 3072-bit key for systems that require RSA. The size is fixed. |
Public key comment is an optional label included at the end of the public-key line. It must fit on one line; surrounding whitespace is removed. The comment does not affect the fingerprint or where the key is authorized.
Generate and review prepares the key and shows its public identity. It does not yet create a secret or replace an existing key.
Import an existing key
Section titled “Import an existing key”Choose Paste existing key and paste an unencrypted OpenSSH private key, beginning with -----BEGIN OPENSSH PRIVATE KEY-----. The field conceals the pasted text.
The phone supports Ed25519 and RSA keys. Imported RSA keys must be between 2048 and 16384 bits. A public-key line, legacy PEM private-key format, other key algorithms, and passphrase-protected private keys are not accepted by this editor.
Review key validates the private key and its matching public identity before showing the preview. The imported key keeps the comment embedded in it. Invalid input produces an error and remains available for correction.
For a key already on a client, agentknock secret upload --from-ssh-key avoids copying private-key text between applications. The CLI can decrypt a passphrase-protected OpenSSH key locally with its passphrase options before uploading it for review.
Review before saving
Section titled “Review before saving”The preview shows the algorithm and bit length, OpenSSH fingerprint, optional comment, and complete public-key line. Use these to identify the prepared key before saving.
Choose another key discards the preparation and returns to the generation or import controls. For an import, the pasted key text is also cleared. The next generation creates new key material.
When creating a secret, select Create secret in the Secret editor to save the prepared key with its name and description. A key that has only been prepared is still an unsaved draft.
Replace an existing key
Section titled “Replace an existing key”In Secret details, expand the SSH key’s Details and select Replace key. The replacement screen shows the current key’s algorithm, size, and fingerprint. It initially offers generation using the current algorithm and comment; you can change those or switch to import.
Prepare and review the new key, then select Replace key to save it. This replaces the stored private key while preserving the secret’s name, description, approval modes, client overrides, and AI instructions. Its temporary access grants end. The previous private key is not kept as a second key in the secret.
Register the new public key with servers and services that should accept it. Agentknock does not remove the old public key from those services. If the public key changes, existing command sessions that were given the old public key cannot use the replacement for later signatures; start a new command to use the new key.
To change only the public comment, use its edit action in Secret details. That leaves the key material and fingerprint unchanged and preserves temporary access.
Unsaved key material
Section titled “Unsaved key material”Back asks whether to discard unsaved key changes. Generation or import failures allow you to correct the input and try again; a failed replacement does not install the prepared key.
Putting the app in the background with a pasted or prepared private key closes the draft and discards that material. Save before switching apps. A brief handoff to device authentication preserves the draft; see Security for authentication and background behavior.