SSH keys

Keys live on your account, not on individual servers, and they are installed during a re-image.

Adding a key does not change any running server. A re-image is the only point at which keys reach a machine — so after adding one, re-image the server you want to use it on.

That is a deliberate limitation: we do not hold credentials that would let us log into your servers and edit authorized_keys behind your back.

Listing keys


curl https://braesystems.com/api/v1/ssh-keys \
  -H "Authorization: Bearer bs_live_..."


const apiKey = "bs_live_...";
 
async function main(): Promise<void> {
  const response = await fetch("https://braesystems.com/api/v1/ssh-keys", {
    headers: {
      Authorization: `Bearer ${apiKey}`,
    },
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
 
  const { data } = (await response.json()) as { data: unknown };
  console.log(data);
}
 
void main();


const apiKey = "bs_live_...";
 
async function main() {
  const response = await fetch("https://braesystems.com/api/v1/ssh-keys", {
    headers: {
      Authorization: `Bearer ${apiKey}`,
    },
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
 
  const { data } = await response.json();
  console.log(data);
}
 
void main();


import requests
 
api_key = "bs_live_..."
 
response = requests.get(
    "https://braesystems.com/api/v1/ssh-keys",
    headers={"Authorization": f"Bearer {api_key}"},
    timeout=30,
)
response.raise_for_status()
 
print(response.json()["data"])


package main
 
import (
	"fmt"
	"io"
	"net/http"
)
 
func main() {
	apiKey := "bs_live_..."
 
	req, err := http.NewRequest("GET", "https://braesystems.com/api/v1/ssh-keys", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+apiKey)
 
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
 
	out, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
 
	fmt.Println(resp.Status, string(out))
}


{
  "data": [
    {
      "id": "7a6b5c4d-3e2f-4a1b-9c8d-7e6f5a4b3c2d",
      "name": "work-laptop",
      "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDjG7RPA1EpqDMvKeai1v1ibjWe2ZBKQRqIEB3PvLJgq you@example.com",
      "fingerprint": "SHA256:qqLkC/YxINXheBw7fxT6z9s92H80dJJkSIuDy3d/GJs",
      "created_at": "2026-07-20T12:00:00.000Z"
    }
  ]
}

Adding a key

Send the public half — the contents of a .pub file. Reading it from disk rather than pasting it is worth the extra line: a key that picks up a stray line break on the way through a clipboard is rejected, and the reason is not obvious from the error.


curl -X POST https://braesystems.com/api/v1/ssh-keys \
  -H "Authorization: Bearer bs_live_..." \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"work-laptop\", \"public_key\": \"$(cat ~/.ssh/id_ed25519.pub)\"}"


import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";
 
const apiKey = "bs_live_...";
 
async function main(): Promise<void> {
  const publicKey = await readFile(join(homedir(), ".ssh", "id_ed25519.pub"), "utf8");
 
  const response = await fetch("https://braesystems.com/api/v1/ssh-keys", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ name: "work-laptop", public_key: publicKey.trim() }),
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
 
  const { data } = (await response.json()) as { data: { fingerprint: string } };
  console.log(data.fingerprint);
}
 
void main();


import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";
 
const apiKey = "bs_live_...";
 
async function main() {
  const publicKey = await readFile(join(homedir(), ".ssh", "id_ed25519.pub"), "utf8");
 
  const response = await fetch("https://braesystems.com/api/v1/ssh-keys", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ name: "work-laptop", public_key: publicKey.trim() }),
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
 
  const { data } = await response.json();
  console.log(data.fingerprint);
}
 
main();


from pathlib import Path
 
import requests
 
api_key = "bs_live_..."
public_key = (Path.home() / ".ssh" / "id_ed25519.pub").read_text().strip()
 
response = requests.post(
    "https://braesystems.com/api/v1/ssh-keys",
    headers={"Authorization": f"Bearer {api_key}"},
    json={"name": "work-laptop", "public_key": public_key},
    timeout=30,
)
response.raise_for_status()
 
print(response.json()["data"]["fingerprint"])


package main
 
import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"path/filepath"
	"strings"
)
 
func main() {
	apiKey := "bs_live_..."
 
	home, err := os.UserHomeDir()
	if err != nil {
		panic(err)
	}
	raw, err := os.ReadFile(filepath.Join(home, ".ssh", "id_ed25519.pub"))
	if err != nil {
		panic(err)
	}
 
	payload, err := json.Marshal(map[string]string{
		"name":       "work-laptop",
		"public_key": strings.TrimSpace(string(raw)),
	})
	if err != nil {
		panic(err)
	}
 
	req, err := http.NewRequest("POST", "https://braesystems.com/api/v1/ssh-keys", bytes.NewReader(payload))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")
 
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
 
	fmt.Println(resp.Status)
}

Supported types: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521, and the sk- hardware-backed variants. Ed25519 is the sensible default.

Keys are validated on the way in, not on the way out to a server. Beyond checking the format, we verify that the algorithm named at the front of the key matches the one encoded inside its body — a mismatch means the key is malformed or hand-edited, and would be silently accepted here only to be rejected by sshd at your first login attempt.

The stored key is normalised, so pasting the same key twice with different whitespace or a different trailing comment is recognised as a duplicate (409 duplicate-ssh-key) rather than creating two rows.

Errors

Response	Cause
`400 invalid-request`	Missing `name` or `public_key`, or a name longer than 64 characters.
`400 invalid-ssh-key`	Not a public key we can parse — including a private key pasted by mistake.
`409 duplicate-ssh-key`	A key with this fingerprint is already on the account.

Deleting a key


curl -X DELETE https://braesystems.com/api/v1/ssh-keys/$SSH_KEY_ID \
  -H "Authorization: Bearer bs_live_..."


const apiKey = "bs_live_...";
const sshKeyId = process.env.SSH_KEY_ID;
 
async function main(): Promise<void> {
  const response = await fetch(`https://braesystems.com/api/v1/ssh-keys/${sshKeyId}`, {
    method: "DELETE",
    headers: {
      Authorization: `Bearer ${apiKey}`,
    },
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
}
 
void main();


const apiKey = "bs_live_...";
const sshKeyId = process.env.SSH_KEY_ID;
 
async function main() {
  const response = await fetch(`https://braesystems.com/api/v1/ssh-keys/${sshKeyId}`, {
    method: "DELETE",
    headers: {
      Authorization: `Bearer ${apiKey}`,
    },
  });
 
  if (!response.ok) {
    throw new Error(`Brae API ${response.status}: ${await response.text()}`);
  }
}
 
void main();


import os
 
import requests
 
api_key = "bs_live_..."
ssh_key_id = os.environ["SSH_KEY_ID"]
 
response = requests.delete(
    f"https://braesystems.com/api/v1/ssh-keys/{ssh_key_id}",
    headers={"Authorization": f"Bearer {api_key}"},
    timeout=30,
)
response.raise_for_status()


package main
 
import (
	"fmt"
	"io"
	"net/http"
	"os"
)
 
func main() {
	apiKey := "bs_live_..."
	sshKeyID := os.Getenv("SSH_KEY_ID")
 
	req, err := http.NewRequest("DELETE", "https://braesystems.com/api/v1/ssh-keys/" + sshKeyID + "", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+apiKey)
 
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
 
	out, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
 
	fmt.Println(resp.Status, string(out))
}

Returns 204. Servers already carrying the key keep it until they are re-imaged — deleting a key does not lock anyone out of a running machine.

Deleting your last key means the next re-image has no key to install, and the request will be rejected. Keep at least one.