How to Generate, Add and Remove SSH Keys in xCloud

To remove an SSH key in xCloud, open Settings → SSH Key, click the delete icon next to the key, type its name and click Delete SSH Key. xCloud then removes that key from every server user that uses it. This guide also shows how to generate a key, add it to xCloud and your servers, take it off one server only, and delete it from your own computer.

An SSH key pair has two parts. The private key stays on your computer. The public key (the .pub file) is what you give to xCloud, which places it on your servers so you can log in without a password. Never paste your private key anywhere.

Which removal do you need?

“Remove an SSH key” can mean four different things. Pick the row that matches what you want to happen.

You want to	Where	What happens
Stop a key from working on all your xCloud servers	Settings → SSH Key → delete icon	xCloud removes the key from every sudo user and site user that uses it, then deletes it from your account
Stop a key from working for one sudo user on one server	Server → Management → Sudo Users → edit icon	Only that user on that server loses the key
Stop a key from working for one site user	Site → Access Data → SSH/sFTP	Only that site user loses the key
Delete the key pair from your own computer	Terminal or PowerShell	The key files are gone from your device. Servers still trust it until you also remove it in xCloud

Step 1: Generate an SSH key on your computer

Open Terminal (macOS, Linux) or PowerShell (Windows) and run:

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to keep the default file location (~/.ssh/id_ed25519). Add a passphrase when asked for better security; you will type it each time the key is used. The comment after -C only labels the key and does not have to be an email address.

If an older system does not support Ed25519 keys, create an RSA key instead:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

Then copy the public key:

# macOS: copy to the clipboard
pbcopy < ~/.ssh/id_ed25519.pub

# Linux: print it, then copy the line
cat ~/.ssh/id_ed25519.pub

# Windows PowerShell: copy to the clipboard
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

A public key is one line that starts with ssh-ed25519 or ssh-rsa. If OpenSSH is not available on Windows, you can create a key pair with PuTTYgen instead.

Step 2: Open your SSH keys in xCloud

Log in to xCloud and go to Settings → SSH Key, or open app.xcloud.host/user/ssh-key. The SSH Keys page lists every key in your team with its Fingerprint, whether it has Auto Provision turned on, and how many sudo users and sites use it (Used By). Click Add New SSH Key.

Step 3: Add the public key and choose where it goes

In Create A New SSH Key, enter an SSH Key Name you will recognise later (for example “Work laptop”) and paste the public key into Public Key. The panel on the right repeats the commands from Step 1 if you need them.

Under Provisioning options you can also put the key on servers straight away:

• Always provision to new servers adds this key to every server you create from now on.
• Select servers to push this key to adds it to the servers you tick.

If you pick either option, fill in Default Sudo User and Default Sudo Password. xCloud creates that sudo user on the servers and gives it this key. The user name must start with a letter and can only contain letters, numbers, underscores and hyphens. It cannot be a name a site on that server already uses.

Click Create SSH Key. The key appears in the list. If you chose servers, xCloud pushes the key to them in the background.

To give the key to a sudo user later, follow Sudo users and site users in xCloud. To use it for one site, add it under Site → Access Data → SSH/sFTP as shown in How to configure SFTP access.

Step 4: Remove an SSH key from xCloud and all your servers

Use this when a laptop is lost, a team member leaves, or you replace an old key.

1. Go to Settings → SSH Key.
2. Click the delete icon in the Actions column of the key.
3. Read the window. It lists each sudo user that uses the key and how many keys that user keeps, plus the sites the key is removed from.
4. Type the key name exactly as shown, spaces included, and click Delete SSH Key.

xCloud then removes the key from every sudo user and site user that uses it on your connected servers, and deletes it from your account. You will not be able to get the key back from xCloud; add it again if you need it later.

If the button stays greyed out, check that the name you typed matches the key name exactly, spaces included. If it does, the key is the only SSH key of a non-root sudo user. The window says so. Add a replacement key to that sudo user first, or delete the sudo user, then try again.

If a server is offline, xCloud cannot change it. The removal stops, the key stays in your account so it can be retried safely, and xCloud emails you “SSH key removal needs attention”. The key may already be removed from some servers; deleting it again finishes the rest. Reconnect the server, then delete the key again.

Step 5: Remove an SSH key from one server only

To keep a key in xCloud but take it off one sudo user, open the server and go to Management → Sudo Users. Click the edit icon of the sudo user.

Clear the key you want to remove from the user’s SSH keys and click Save. xCloud updates the user on the server. A sudo user needs at least one SSH key, so add the new key before you remove the old one.

Editing sudo users needs two-factor authentication on your account. Without it, xCloud sends you to the two-factor settings first.

For a site user, open the site, go to Access Data → SSH/sFTP, clear the key under SSH Authentication and click Save.

Step 6: Remove an SSH key from your own computer

Removing a key in xCloud does not delete anything on your computer. To get rid of the key pair locally, delete both files:

# macOS and Linux
rm ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub

# Windows PowerShell
Remove-Item $env:USERPROFILE\.ssh\id_ed25519, $env:USERPROFILE\.ssh\id_ed25519.pub

Replace id_ed25519 with your key’s file name (for example id_rsa). Run ls ~/.ssh first to see which keys you have.

If you loaded the key into your SSH agent, unload it too:

# remove one key from the agent
ssh-add -d ~/.ssh/id_ed25519

# remove every key from the agent
ssh-add -D

Delete the private key only if nothing else uses it. The same key may also be added to GitHub, GitLab or another server, and those keep trusting it until you remove it there too.

Remove an old server fingerprint (ssh-keygen -R)

After you rebuild a server or reuse its IP, SSH can warn that the remote host identification has changed. That warning is about the server’s host key saved on your computer, not your own key. Remove the old entry, then connect again:

ssh-keygen -R SERVER_IP

Only do this when you know the server was rebuilt or replaced.

Keys added by hand on the server

You can also remove a key by deleting its line from ~/.ssh/authorized_keys on the server. For users that xCloud manages, do not rely on this. xCloud writes the full authorized_keys file of a sudo user or site user each time it updates that user’s keys, so keys added or removed by hand there can change on the next update. Manage those keys in xCloud instead.

To limit SSH logins further, see How to configure SSH lockdown and How to update the SSH port in xCloud. To run commands without your own key, use the web terminal.

Frequently asked questions

Does deleting an SSH key in xCloud remove it from my servers?

Yes. When you delete a key under Settings → SSH Key, xCloud removes it from every sudo user and site user that uses it on your connected servers, then deletes it from your account. It does not touch the key files on your own computer.

Why is the Delete SSH Key button greyed out?

Either the name you typed does not match the key name exactly (spaces included), or the key is the only SSH key of a non-root sudo user. Add a replacement key to that sudo user, or delete the sudo user first, then try again.

What happens if a server is offline when I delete a key?

xCloud cannot change a server it cannot reach, so the removal stops and the key stays in your account. xCloud emails you that the SSH key removal needs attention. The key may already be removed from some servers; deleting it again finishes the rest. Reconnect the server and delete the key again.

How do I remove an SSH key from my own computer?

Delete both files of the key pair, for example rm ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub, and run ssh-add -D to clear keys loaded in your SSH agent. Remove the key from xCloud too, so no server still trusts it.

If you run into any issues with SSH keys, feel free to reach out to our support team.