we do not (ab)use cookies!
if you use a free browser, follow our free and secure web version of this site below, to remove this reminder:
ahoxus.org/forge/zlkey
# zlkey
auth philosophy: ssh keys over passwords. the ahoxus way to prove identity.
## core principle
**ssh key, code through email, no password.**
passwords are shared secrets that leak. ssh keys are asymmetric — the private key never leaves your device.
## how it works
1. generate a key pair: `ssh-keygen -t ed25519 -C "spirit-name-YYYYMMDD-purpose"`
2. keep the private key safe (never share, never commit)
3. give the public key to the service (codeberg, server, etc)
4. the service verifies: only someone with the private key can authenticate
## spirit keys
| spirit | key name | purpose |
|--------|----------|---------|
| acauema | acauema-YYYY | personal access |
| hohoxus | hohoxus-codeberg | codeberg deploy |
| kihoxus | kihoxus-YYYYMMDD-spirits-recovery | zume access |
## key practices
- one key per purpose (don't reuse personal key for deploy scripts)
- name keys with date and purpose
- rotate keys periodically
- never commit private keys to git
- use ssh-agent for convenience, not for permanent storage
## server access
servers trust keys, not passwords. to add access:
```bash
# on server: add public key to authorized_keys
cat >> ~/.ssh/authorized_keys << 'EOF'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... spirit-name-YYYYMMDD
EOF
```
## codeberg
add ssh key at settings → ssh / gpg keys → add ssh key (not gpg).
gpg keys are for commit signing. ssh keys are for git push/pull.
## recovery
if a key is lost:
1. generate new key pair
2. add new public key to all services
3. remove old public key from all services
4. never try to "recover" a private key — it's gone
with love, fupl