> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cngn.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Generating SSH Keys

> Create the Ed25519 key pair used to encrypt API responses to you

The cNGN API encrypts every response payload to an **Ed25519 public key** you upload to your dashboard. This guide creates the key pair and copies the public key, on any operating system.

<Steps>
  <Step title="Generate the key pair">
    ```bash theme={null}
    ssh-keygen -t ed25519 -C "your_email@example.com"
    ```

    The command prompts you for:

    * **Save location**: press Enter to accept the default (`~/.ssh/id_ed25519`), or provide a dedicated path such as `~/.ssh/cngn_api_key`
    * **Passphrase**: optional; press Enter to skip

    This produces two files: the private key (`id_ed25519`) and the public key (`id_ed25519.pub`).

    <Note>
      If you set a passphrase, your integration needs it to load the private key when decrypting responses. For server-side automation, most teams skip the passphrase and rely on filesystem permissions and secret management instead.
    </Note>
  </Step>

  <Step title="Copy the public key">
    <Tabs>
      <Tab title="macOS">
        ```bash theme={null}
        cat ~/.ssh/id_ed25519.pub | pbcopy
        ```
      </Tab>

      <Tab title="Linux">
        ```bash theme={null}
        cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard
        ```

        Or simply print it and copy manually:

        ```bash theme={null}
        cat ~/.ssh/id_ed25519.pub
        ```
      </Tab>

      <Tab title="Windows (PowerShell)">
        ```powershell theme={null}
        Get-Content ~\.ssh\id_ed25519.pub | Set-Clipboard
        ```
      </Tab>
    </Tabs>
  </Step>

  <Step title="Upload it to your dashboard">
    Paste the copied public key into the SSH public key field on the API Key tab of your dashboard settings. Full walkthrough: [Generating API Keys](/guides/security/generating-api-keys).
  </Step>
</Steps>

## Public vs. private key

| File                      | Can be shared?                  | Role                                        |
| ------------------------- | ------------------------------- | ------------------------------------------- |
| `id_ed25519.pub` (public) | Yes, upload to the dashboard    | The platform encrypts responses with it     |
| `id_ed25519` (private)    | Never, keep on your server only | Your integration decrypts responses with it |

<Warning>
  Your private key must remain protected at all times and never be disclosed to anyone. If it's ever exposed, generate a new pair and update the dashboard immediately.
</Warning>

Next: use the private key to decrypt responses in [Encrypting & Decrypting Requests](/guides/encryption).