Adding an SSH public key to a cPanel account

Confirm the service includes shell or SFTP access and obtain the actual hostname, port and username. Generate a modern supported key on the trusted client, protect its private key with an appropriate passphrase and record its fingerprint.

1. Open SSH Access > Manage SSH Keys in cPanel and choose Import Key.
2. Give the key a descriptive name and paste the public-key line into the public-key field. Do not upload the client’s private key merely to allow inbound login.
3. Import the public key, then use its Manage action and choose Authorize. An imported but unauthorised key will not grant access.
4. From the trusted client, connect using the correct username, port and private-key file. Verify the server host-key fingerprint through a trusted provider source before accepting it.
5. Test a harmless command or SFTP listing and document the key’s owner and intended lifetime. Keep the existing recovery method until the new access is verified.

On a trusted computer with OpenSSH installed, replace the key path, SSH port, cPanel username and hostname below with the values for your service. The path points to the private key on your computer.

ssh -i /path/to/private_key -p SSH_PORT CPANEL_USER@SSH_HOST

-i selects the identity file and lowercase -p selects the server port. Verify the server host-key fingerprint through a trusted support or service record before accepting a new host. A prompt for the key passphrase unlocks your local private key; it is different from a hosting-account password prompt.

Once connected to a shell-enabled account, run pwd and id to confirm the location and account, then use exit to disconnect. If the client falls back to another login method, investigate the selected key and its authorization before treating the test as successful.

The key should authenticate to the correct hosting account and provide only the access included with that service. It does not grant root privileges.

If authentication fails, check authorization status, the selected private key, username and shell eligibility. Do not repeatedly paste private material into support chats. A lost or exposed key should be revoked and replaced.

Use a separate key for each person or automation task where practical. This makes revocation and attribution clearer and avoids replacing everyone’s access when one device is lost.

• Revoking an old SSH key after a developer leaves
• Using cPanel Terminal for a read-only first diagnosis
• Connecting FileZilla to hosting with FTPS or SFTP
• Cloning a private Git repository through cPanel

• cPanel: SSH Access

• OpenSSH: ssh client identity and port options