Choose an SSH private key for Git commands

For one Git command in a POSIX shell, set GIT_SSH_COMMAND with the intended key. For recurring use with several accounts, host aliases in SSH configuration are usually easier to maintain. These settings apply to SSH remotes, not HTTPS authentication.

Select a key for one command

GIT_SSH_COMMAND='ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_work' \
  git clone git@github.com:org/repo.git

-i names an identity file. IdentitiesOnly=yes excludes additional agent identities that were not explicitly configured, but multiple configured IdentityFile entries can still apply. Quote paths containing spaces appropriately for both the shell and SSH command string.

In PowerShell, $env:GIT_SSH_COMMAND = 'ssh ...' changes the environment of the current process. It is not automatically limited to the next command; restore its previous value or remove it afterward.

Use a host alias for each account

In ~/.ssh/config:

Host github-personal
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_personal
    IdentitiesOnly yes

Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_work
    IdentitiesOnly yes

Then use the alias in the remote URL:

git clone git@github-work:org/repo.git

For an existing repository, update its intended remote with git remote set-url origin git@github-work:org/repo.git. Other matching SSH configuration blocks still matter; scalar options generally use the first obtained value, while identity files can accumulate.

Agent and repository-specific alternatives

An agent can keep a key available without repeatedly entering its passphrase:

# Start an agent only if your session does not already provide one.
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519_work

Loading a key does not guarantee it is the identity selected for every host. A server may accept another configured identity first, or reject too many authentication attempts before reaching the desired key.

To configure this repository's SSH command:

git config --local core.sshCommand 'ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_work'

GIT_SSH_COMMAND overrides core.sshCommand. Neither setting is a substitute for ensuring the public key has the intended repository permissions.

Inspect and troubleshoot

ssh -G github-work prints the effective configuration without initiating an SSH session. To verify authentication, use ssh -T git@github-work; GitHub's successful authentication message does not imply interactive shell access. For a remote-reference check:

GIT_SSH_COMMAND='ssh -v -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_work' \
  git ls-remote origin

Inspect identity-offering and acceptance messages locally. On Unix-like systems, restrictive private-key permissions commonly use chmod 600 KEY_FILE and chmod 700 ~/.ssh; Windows OpenSSH uses its own permission and ACL checks. Never print private-key contents.

Commit user.name and user.email do not select the SSH account. In CI, use a narrowly scoped key delivered to a protected temporary file. Verify server host keys through a trusted channel, provision known_hosts, and retain strict host checking. A key-path variable must contain a filename, not the key's text; clean up temporary material after use.

See OpenSSH configuration, Git SSH environment variables, and GitHub SSH fingerprints.