Manage SSH keys for a file server account

A Celigo-hosted SFTP file server account can authenticate with SSH public keys instead of, or in addition to, a password. Register the account-holder's public key on the account, and they connect with the matching private key — no password is sent. This article explains which key types are accepted, how to add and remove keys, how to read a key's fingerprint, and how to rotate keys without interrupting the account-holder. It's for anyone who administers file server accounts; the account-holder's side — generating a key pair and configuring their client — is covered in Connect to a Celigo-hosted SFTP file server.

Accepted key types

The file server accepts these public key types:

• Ed25519
• ECDSA
• RSA, 2048 bits or longer

DSA keys and RSA keys shorter than 2048 bits are rejected. The key must be in the standard OpenSSH public key format — a single line beginning with the key type, for example ssh-ed25519 AAAA.... An account can have up to 10 keys.

Add a key

1. Select an environment.
2. Go to Resources , and then select File storage.
3. Select SFTP file server.
4. Under File server settings, select Accounts.
5. Open the account.
6. Under SSH public keys, select Add key.
7. Paste the public key into the box and save.

The key takes effect as soon as you save — the account-holder can connect with it on their next attempt. The account shows each key's SHA-256 fingerprint; the key itself isn't displayed again. The full public key is available through the file server API.

You can register up to 10 keys per account. All registered keys are active at the same time.

Verify a key by its fingerprint

Each registered key shows a SHA-256 fingerprint. To confirm you registered the right key, ask the account-holder to run ssh-keygen -lf <their-public-key-file> and compare the fingerprint they report with the one shown on the account. A fingerprint mismatch means the wrong key was pasted — remove it and add the correct one.

Remove a key

1. Open the account as described in Add a key.
2. Under SSH public keys, find the key by its fingerprint and key type, select Remove, and save your changes.

Removal takes effect when you save. Removing a key ends all of the account's active sessions, not only the one using that key; the account-holder reconnects with a remaining key or their password.

An enabled account must keep at least one credential. If the key you're removing is the account's only credential — there's no password and no other key — you're prompted to disable the account instead. To keep the account enabled, add a replacement key or set a password first.

Rotate a key without downtime

Because multiple keys can be active at once, an account-holder can switch to a new key with no interruption:

1. Add the account-holder's new public key to the account.
2. Ask the account-holder to switch their client to the new private key and confirm they can connect.
3. Remove the old key between transfers — removing a key ends the account's active sessions, so a transfer in progress at that moment is canceled. The account-holder reconnects with the new key.

If the old key may have been exposed, reverse the order — remove the old key first, which blocks it as soon as you save, and then add the new one. The account-holder can't connect in between unless they also have a password.

Use keys together with a password

Password and key authentication coexist on an account. If both are set, the account-holder can use either. To require keys only, create the account with a key and no password — a password can't be removed from an existing account in integrator.io, only through the file server API (see Create and manage file server accounts). To stop a specific key without affecting the password, remove just that key.

Adding and removing keys is recorded in the platform audit log, attributed to the user who made the change. Audit entries never contain the key material.