Login using default SSH key

[Harvie]

Describe the feature or problem you’d like to solve

I have full access to github repository using ssh key and my ssh client uses this key by default. Why do i need to login using gh auth login? Can't you just try to autologin using default ssh key without any additional tokens???

Proposed solution

I want to install gh, change directory to git working tree (with properly set github origin) and use gh without need for any aditional login. Just use it the same way i can do git push -f origin master without any login (since i already have ssh key setup on github).

Or at least automaticaly acquire the token using the ssh-key at the first start without being so unnecessarily interactive and boring.

[DJLink]

You can use
gh config set -h github.com git_protocol ssh
to set default protocal to ssh
it's just that default is https

see this for more info, it helped me #1347

[vilmibm]

Sorry for the confusion. It's not possible to authenticate with GitHub via SSH; SSH is just for the underlying git repos. Just like you have to log into github.com in the browser before you can interact with your repositories you need to use gh auth login.

[Harvie]

Sorry for the confusion. It's not possible to authenticate with GitHub via SSH; SSH is just for the underlying git repos. Just like you have to log into github.com in the browser before you can interact with your repositories you need to use gh auth login.

I know. That is why i've opened this issue in the first place. Can you please add this feature?

[Harvie]

And yes, i am fully aware that this would probably mean to add SSH based auth service to the github servers.

[mislav]

@Harvie This idea has come up before and I've asked around internally, but it seems that this feature would be unfeasible to add to our infrastructure at the moment. Sorry!

Ref. #297

[jonathan-enf]

This feature would be very useful. ssh-based authentication is much more secure than keeping an oath token on disk in plaintext.

Since this oauth token allows users to add or remove ssh keys, this basically reduces the security of the whole system to the security of a single plaintext token.

[mislav]

@jonathan-enf That's a fair point. While authenticating to the GitHub API will likely never be possible via SSH protocol, we do plan to make the stored authentication token more secure: #449

Meanwhile, to avoid gh storing the token internally in a possibly insecure location, you can set the GH_TOKEN environment variable. Your shell initialization script could populate that variable from a secure storage.

Finally, gh auth token does not have permissions to write SSH keys by default. It only asks for admin:public_key scope when you explicitly choose to upload an SSH key via gh.

[egberts]

Millions of new headless CLI-only servers, that were using Github as a repo, got the abrupt halt from automation of its own creation.

I merely count as one.

[hlung]

You can use gh config set -h git_protocol ssh to set default protocal to ssh it's just that default is https

see this for more info, it helped me #1347

This one give me this error:

gh config set -h git_protocol ssh
accepts 2 arg(s), received 1

I have to use this instead:

gh config set git_protocol ssh

After that, my CocoaPods SSH urls works even i did gh login with https.

[daniel-garcia]

While not a published rfc, OCI (oracle cloud infrastructure) does support making calls to their API using SSH keys. This is done via

https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12

The private key is used to sign the message body, much like AWS v4 signatures. The header includes the name of the SSH key. On the server side, the public key is looked up and used to verify the signature of the request. Once that happens, there is a mapping of a User to a request. The big caveat is that the SSH keys registered as authentication keys must be globally unique. This isn't true for registered git keys in Github; multiple users, orgs, etc can use the same SSH key.

Perhaps Github could consider adding something like this:
https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm

That key, however, would need to be UNIQUE per user.

[volas]

Some commands should be possible to use with only ssh, like repo clone or pr checkout. And I don't mind to use browser for more complex tasks.

[hseg]

And I don't mind to use browser for more complex tasks.

I do mind using the browser -- needing to leave the terminal for a fresh auth flow is already annoying. Needing to do so when the service I'm authenticating to already has the necessary key material to avoid this problem altogether is even more annoying. Being misled by the prompt into believing the use of the SSH key is as authentication material, rather than identification material, is just the cherry on top.

[huyz]

I'd like to add that this would also be useful for https://docs.github.com/en/copilot/github-copilot-in-the-cli/using-github-copilot-in-the-cli . Unless someone has a better idea, it looks like I have to also use a web auth flow in all my remote hosts just so I can use copilot at the CLI. Would be much convenient if the creds could be obtained from my forwarded ssh agent