neosourceDocs
Search docs

Add an SSH public key

POST/api/user/ssh-keys

addSshKey

Session-authenticated caller only. Registers a new SSH public key for the authenticated user. Accepts keys in OpenSSH authorized_keys format.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/user/ssh-keys' \
  -b 'ns_session=$NEOSOURCE_SESSION' \
  -H 'Content-Type: application/json' \
  -d '{"name":"laptop","public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host"}'

fetch

fetch("https://neosource.dev/api/user/ssh-keys", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({"name":"laptop","public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host"}),
});

Request bodyrequired

application/json

AddSshKeyRequest

object

namerequired

string

A human-readable label for the key (e.g. "laptop", "ci-bot").

example"laptop"

public_keyrequired

string

The public key in `OpenSSH` `authorized_keys` format.

example"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@host"

additional propertiesnot allowed

Responses

201SSH key created

application/json

SshKeyResponse

object

algorithmrequired

string

created_atrequired

integerint64

fingerprintrequired

string

key_idrequired

string

namerequired

string

403Forbidden — one of: forbidden, needs_scope

application/json

one of
  • ErrorForbidden

  • NeedsScopeError

    object

    `403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.

    errorrequired

    string

    Always `needs_scope` — this body exists to carry the extra fields that kind needs.

    "needs_scope"

    scoperequired

    string

    The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

  • 400Bad Request — one of: invalid_input
  • 401Authentication required
  • 404Not Found — one of: not_found
  • 409Conflict — one of: already_exists, conflict
  • 429Rate limited — retry after the `Retry-After` header
  • 500Internal server error
  • 503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
  • 504Gateway timeout — the request exceeded the server's handling budget