openpubkey/opkssh

Health v2 · maintenance only

Adoption not part of the score

2048 stars · 105 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

opkssh is a Go CLI tool that enables SSH authentication via OpenID Connect identities instead of long-lived SSH keys. It generates SSH public keys containing PK Tokens and configures sshd to verify them, building on the OpenPubkey protocol.

Use cases

• manage ssh access with email identities instead of ssh keys
• log into servers using google or microsoft accounts
• replace long-lived ssh keys with openid connect
• configure sshd to verify oidc-based ssh keys
• ssh with gitlab account credentials
• rotate ssh access automatically via identity provider

When to choose

• you want ssh access tied to short-lived identity-provider sessions rather than static keys
• your organization already uses an oidc provider like keycloak, azure ad, or google workspace
• you need centralized, auditable ssh access management

When to avoid

• you need ssh access without network access to an openid provider
• your environment requires traditional key-based or certificate-based ssh only
• you cannot modify sshd configuration on target servers

Facets

cli-tool · maturity active

auth security ssh security developer-tools networking windows cli go ssh oidc openid-connect pk-token authentication zero-trust linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="openpubkey/opkssh")