SSH Keys API

SSH public keys registered to your tenant can be used for alternative authentication flows. Keys are tenant-scoped and synced to all proxies automatically.

List SSH Keys

GET/api/auth-keys

bash

curl https://cifp.vril.dev/api/auth-keys \
  -H "Authorization: Bearer cifp_your_api_key"

Response

{
  "keys": [
    {
      "id":          "uuid",
      "name":        "my-laptop",
      "keyType":     "ssh-ed25519",
      "fingerprint": "SHA256:abc123...",
      "lastUsedAt":  null,
      "expiresAt":   null,
      "createdAt":   "2026-06-01T10:00:00Z"
    }
  ],
  "count": 1
}

Public key material is not included in the list response.

Register SSH Key

POST/api/auth-keys

bash

curl -X POST https://cifp.vril.dev/api/auth-keys \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name":      "my-laptop",
    "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host",
    "expiresAt": "2027-01-01T00:00:00Z"
  }'

Field	Required	Description
name	Yes	Display name for the key. 1–100 chars.
publicKey	Yes	Full SSH public key string (ssh-ed25519, ssh-rsa, ecdsa-...).
expiresAt	No	ISO-8601 expiry datetime.

Returns 409 if the key's fingerprint is already registered.

Response (201)

{
  "id":          "uuid",
  "name":        "my-laptop",
  "keyType":     "ssh-ed25519",
  "fingerprint": "SHA256:abc123...",
  "expiresAt":   null,
  "createdAt":   "2026-06-06T09:00:00Z"
}

Remove SSH Key

DELETE/api/auth-keys/:id

Deletes the key and syncs the removal to all tenant proxies. Any active sessions or tokens signed by this key will be rejected on next validation.

bash

curl -X DELETE https://cifp.vril.dev/api/auth-keys/key-uuid \
  -H "Authorization: Bearer cifp_your_api_key"

# Returns 204 No Content