GitHub’s implementation of git over ssh identifies accounts (for purposes of access control) solely by ssh public key. As a consequence, a particular public key can be associated with, at most, one account. Deploy keys are even more restricted - they can only be associated with a single repository. While ssh can try several keys, GitHub doesn’t know what you’re trying to access until after you authenticate, so a workaround is required to select the right key.

When I ran into this problem, my solution was to add a little magic to my ~/.ssh/config

1# apply these config options to matching hosts
2Host *
3# don't attempt to use keys from ssh-agent
4# unless they are explicitly listed here
5IdentitiesOnly yes
6# this specifies which key to use - %h
7# will be expanded to the hostname
8IdentityFile ~/.ssh/%h_id_rsa
9# for purposes of server verification,
10# pretend the hostname is
12# since the hostname provided is wrong
13# we use netcat as a proxy to ignore it
14# and connect to anyway
15ProxyCommand nc 22

The trick here is the “%h” expansion in the IdentityFile parameter, which makes this single config block work for as many users and deploy keys as you like. Once this is in place, you can use ssh-keygen -b 2048 -t rsa -f ~/.ssh/IDENTIFIER.github.com_id_rsa to create a new keyfile, where “IDENTIFIER” is your username, or in the case of a deploy key, the repository name (really, it can be anything, but having a naming scheme avoids confusion later). Then, when cloning or setting remotes, you’ll use “” instead of just “”.

Once you have the public key added on GitHub, you can test that the key is working:

$ ssh -T
Hi ryancdotorg! You've successfully authenticated, but GitHub does not provide shell access.

This will probably work on other services that use git over ssh, but I’ve only tested it on GitHub.

If you enjoyed this, please consider donating to help with my legal costs.
I’m suing the British government for legal recognition of the gender listed on my birth certificate. -->