# Using Bitwarden as your SSH Agent with an SSH config file
**URL:** https://bawmedical.co.uk/t/using-bitwarden-as-your-ssh-agent-with-an-ssh-config-file/1767
**Category:** blog
**Created:** [13 October 2026 19:11 UTC](https://bawmedical.co.uk/t/using-bitwarden-as-your-ssh-agent-with-an-ssh-config-file/1767 "2026-10-13T19:11:10Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@marcusbaw](https://bawmedical.co.uk/u/marcusbaw)
#### Post date: [13 October 2026 19:11 UTC](https://bawmedical.co.uk/t/using-bitwarden-as-your-ssh-agent-with-an-ssh-config-file/1767/1 "2026-10-13T19:11:11Z")
If you SSH into servers and authenticate to Git remotes with SSH, you probably have SSH keys stored on your local machine, and you are probably slightly uncomfortable about this. It doesn’t seem quite right, when we are claiming that SSH keys are ‘more secure’, to just have them lying about on your machine.
I found out only quite recently that Bitwarden has the ability to hold SSH private keys **in your vault** , presenting those keys when needed for SSH authentication, without the keys ever leaving Bitwarden.
This means we can have the convenience of SSH key auth, but with the actual keys being held in your Bitwarden vault. The point-and-click relative ease of creating new keys in Bitwarden makes it quite easy to get into the habit of having **single-purpose keys** for each server or service, which is another good security practice.
While the setup is straightforward, there isn’t anything in the Bitwarden docs about using an **SSH config file** to make it work smoothly with multiple servers, and very little when searching the web, so I thought I’d write up a quick guide to how I set it up and got it working with my servers.
* * *
## Assumptions / Prerequisites
- You need a Bitwarden account.
- The [Bitwarden Desktop app](https://bitwarden.com/download/) should be installed on your machine.
- You will need SSH access to a server for testing.
* * *
## Create an SSH key in Bitwarden
Open the Bitwarden app, authenticate if needed, and click the “Add item” button. Choose a name that describes the purpose of the key, e.g. `myserver.example.com`.
Bitwarden will generate a new `ed25519` keypair for you, and store the private key in the vault.
**Tip** : Name your keys with a consistent naming scheme, because we are going to want to refer to them later in the setup.
SSH keys get their own type in the Bitwarden vault. You can also **import existing private keys** by pasting them into an SSH key item via the desktop app, which makes migrating existing keys easy. Keys are available immediately via the SSH agent once stored.
* * *
## Enable Bitwarden SSH Agent on your machine (macOS / Windows / Linux)
In **Bitwarden Desktop** , go to **Settings** \> **SSH Agent** and toggle it on.
This makes Bitwarden expose an SSH agent socket that tools like `ssh`, `ssh-add`, and Git can use.
**Test** : Open a new terminal and run:
```bash
ssh-add -L
```
You should get a list of your public keys that are stored in Bitwarden.
If you get “Could not open a connection to your authentication agent” or “Error connecting to agent: Connection refused”, check that Bitwarden is running, and restart your shell session to pick up the Bitwarden agent socket (`SSH_AUTH_SOCK`). The Bitwarden docs cover OS-specific setup.
### Linux flatpak note
If you installed Bitwarden as a Flatpak, the agent socket lives at:
```auto
~/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock
```
To make this available to all apps (including GUI apps like VS Code that don’t inherit your shell environment), create `~/.config/environment.d/ssh-agent.conf`:
```auto
SSH_AUTH_SOCK=/home/YOUR_USER/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock
```
This is picked up by systemd user services and by Wayland compositors at login.
## Create a public key file
Bear with me, yes I do mean public key file. SSH chooses keys per server using the `IdentityFile` in `~/.ssh/config`, but since our private keys live in Bitwarden, we give SSH a public key file that matches the key in the vault. `ssh` then asks the Bitwarden agent for the corresponding private key, and the private key itself never leaves Bitwarden - the public key file is just a reference.
Create a file in `~/.ssh` with the same name as your server, but with a `.pub` extension, e.g. `~/.ssh/myserver.example.com.pub`.
Copy the public key from Bitwarden’s UI into that file. You can get the public key from the Bitwarden app by clicking on the SSH key item, and copying the “Public Key” field, and paste it into the new file.
* * *
## Make SSH use the Bitwarden agent (via `~/.ssh/config`)
If you are used to using `ssh` with a config file, you will have entries like this for your servers:
```sshconfig
Host myserver
HostName myserver.example.com
User ubuntu
IdentityFile ~/.ssh/id_rsa
```
To make SSH use the Bitwarden agent instead of a local key file, point `IdentityFile` at the **public** keyfile from the preceding step:
```sshconfig
Host myserver
HostName myserver.example.com
User ubuntu
IdentitiesOnly yes
IdentityFile ~/.ssh/myserver.example.com.pub
```
- `IdentitiesOnly yes` helps avoid “too many authentication failures” if you have lots of keys available.
* * *
## Add the public key to your server, and test
Copy the **public** key from Bitwarden’s UI into the correct user’s `~/.ssh/authorized_keys` on the server you want to log into, then run:
```bash
ssh myserver
```
If it works, you’re in.
If not, run with debug output:
```bash
ssh -vvv myserver
```
which will show which authentication methods and identities are being attempted. You should see that the agent is being used, and the correct key is being offered.
* * *
## Agent forwarding (use your keys from inside an SSH session)
This is useful if you:
- SSH into a server and need to `git pull` from GitHub there
- hop from server A to server B (jump host style) while still using your local Bitwarden-held keys
### Enable forwarding for specific hosts (recommended)
In `~/.ssh/config`, for the servers where you want this:
```sshconfig
Host myserver
HostName myserver.example.com
User ubuntu
ForwardAgent yes
IdentitiesOnly yes
IdentityFile ~/.ssh/myserver.example.com.pub
```
Now SSH in:
```bash
ssh myserver
```
On the remote machine, check:
```bash
ssh-add -L
```
If forwarding is working, you’ll see your keys listed on the remote machine, even though the private keys remain in Bitwarden on your local machine.
**Security note:** only forward your agent to machines you trust. Forwarding gives that remote machine the ability to _use_ your agent while you are connected.
* * *
## GitHub over SSH (secondary setup)
Once server SSH is working, adding GitHub is straightforward.
In GitHub:
**Settings → SSH and GPG keys → New SSH key**
Paste the contents of your `*.pub` file.
For predictable key selection, add this block to `~/.ssh/config`:
```sshconfig
Host github.com
HostName github.com
User git
IdentitiesOnly yes
IdentityFile ~/.ssh/github.com.pub
```
Test:
```bash
ssh -T git@github.com
```
Then test a Git operation:
```bash
git clone git@github.com:OWNER/REPO.git
```
(or `git fetch`, `git push` in an existing repo)
* * *
## References
- [Bitwarden SSH Agent docs](https://bitwarden.com/help/ssh-agent/)
- [Bitwarden community: BW ssh-agent and .ssh/config](https://community.bitwarden.com/t/bw-ssh-agent-and-ssh-config/82363) - confirms the `man ssh_config` behaviour that allows a public key file as an `IdentityFile` when the private key lives in an agent.
---
### Author:  [@marcusbaw](https://bawmedical.co.uk/u/marcusbaw)
#### Post date: [13 October 2026 19:14 UTC](https://bawmedical.co.uk/t/using-bitwarden-as-your-ssh-agent-with-an-ssh-config-file/1767/2 "2026-10-13T19:14:28Z")
A handy companion script for this setup: it finds a public key in the Bitwarden SSH agent by exact comment match and writes it into `~/.ssh` as a ready-to-use `.pub` file.
```bash
#!/usr/bin/env bash
set -euo pipefail
if [[$# -ne 1]]; then
echo "Usage: $(basename "$0") ''" >&2
exit 2
fi
comment="$1"
slugify() {
printf '%s' "$1" \
| tr '[:upper:]' '[:lower:]' \
| sed -E '
s/[[:space:]]+/-/g;
s/[^a-z0-9._-]+/-/g;
s/-+/-/g;
s/^-|-$//g
'
}
slug="$(slugify "$comment")"
out="$HOME/.ssh/${slug}.pub"
mkdir -p "$HOME/.ssh"
chmod 700 "$HOME/.ssh" 2>/dev/null || true
# Ensure agent is available
if ! ssh-add -L >/dev/null 2>&1; then
echo "Error: ssh-agent not available or no keys exposed." >&2
exit 3
fi
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
# Exact comment match (Bitwarden style, spaces allowed)
ssh-add -L | awk -v want="$comment" '
{
c=""
for (i=3; i<=NF; i++) c=c (i==3 ? "" : " ") $i
if (c == want) { print; found=1; exit }
}
END { exit found?0:1 }
' > "$tmp" || {
echo "Error: No public key found with comment exactly:" >&2
echo " $comment" >&2
exit 4
}
install -m 600 "$tmp" "$out"
echo "Wrote: $out"
echo "Fingerprint:"
ssh-keygen -lf "$out"
```
### Usage
```auto
./bw-ssh-pubkey-export.sh
```
---
### Author:  [@system](https://bawmedical.co.uk/u/system)
#### Post date: [13 October 2026 20:11 UTC](https://bawmedical.co.uk/t/using-bitwarden-as-your-ssh-agent-with-an-ssh-config-file/1767/3 "2026-10-13T20:11:18Z")
This topic was automatically closed after 60 minutes. New replies are no longer allowed.