I have to run this command since upgrading to macOS:

ssh-add -K

Corrects the problem after the reboot but I have to run this command every time I log on to my computer.

If I do not run the command above, my keys in ~/.ssh are skipped and I am being asked server password in order to establish the connection.

  • 1
    $ ssh-add -K gives me ssh-add: illegal option -- K
    – modius
    Commented Oct 2, 2016 at 11:58
  • 2
    You will need to enter the private key path after -K. See @JakeGould 's answer for resolution.
    – misaligar
    Commented Oct 2, 2016 at 13:49
  • The 10.12.2 update eliminated some unnecessary server password requests for me. You may now no longer need to run the ssh-add -K. Commented Dec 16, 2016 at 13:22
  • 1
    Also see apple.stackexchange.com/questions/48502/…
    – Ben Creasy
    Commented Feb 18, 2018 at 23:41
  • @modius Make sure you are running the correct version of ssh-add: It should be /usr/bin/ssh-add, not something installed by homebrew, conda, etc.
    – mforbes
    Commented Sep 26, 2021 at 0:20

11 Answers 11


As of macOS Sierra 10.12.2 Apple added an ssh_config option called UseKeychain which allows a 'proper' resolution to the problem. Add the following to your ~/.ssh/config file:

Host *
   AddKeysToAgent yes
   UseKeychain yes     

From the ssh_config man page on 10.12.2:


On macOS, specifies whether the system should search for passphrases in the user's keychain when attempting to use a particular key. When the passphrase is provided by the user, this option also specifies whether the passphrase should be stored into the keychain once it has been verified to be correct. The argument must be 'yes' or 'no'. The default is 'no'.

  • 3
    According to this link: openradar.appspot.com/27348363 Apple has "re-aligned [their] behavior with the mainstream OpenSSH in this area".
    – ThomasW
    Commented Dec 16, 2016 at 6:11
  • 20
    It's absurd that Apple modified behaviour in a way which will cause issues for the vast majority of developers (because of GitHub push if nothing else) and said nothing to anyone!
    – mluisbrown
    Commented Dec 16, 2016 at 12:58
  • 10
    I think the IdentityFile ~/.ssh/id_rsa is redundant and not needed (when looking at default options). I've never set that option in my ssh config file. Commented Dec 19, 2016 at 11:15
  • 9
    @JakeGould IMO changing ~/.ssh/config~ is preferable as it solves the problem at the ssh level. Not 100% sure that the .bash_profile mod will work for GUI clients using ssh without using a shell.
    – mluisbrown
    Commented Dec 20, 2016 at 16:25
  • 7
    Apple published Technical Note TN2449 regarding that change.
    – Kentzo
    Commented Mar 3, 2017 at 22:08

I had this issue as well when attempting to deploy some code using Capistrano. Very frustrating. Here are two methods I know of to deal with this issue.

Method 1: Add all known keys to the SSH agent.

So one solution I found is to run ssh-add with the -A option—which adds all known identities to the SSH agent using any passphrases stored in your keychain—like this:

ssh-add -A

Now this works but it won’t persist across reboots. So if you want to never worry about this again, just open up your user’s ~/.bash_profile file like this:

nano ~/.bash_profile

And add this line to the bottom:

ssh-add -A 2>/dev/null;

Now when you open a new Terminal window, all should be good!

Method 2: Add only SSH keys that are in the keychain to the agent.

So while the ssh-add -A option should work for most basic cases, I ran into an issue recently where I had 6-7 Vagrant boxes (which uses SSH keys/identities for access) setup on a machine on top of the more common id_rsa.pub in place.

Long story short, I ended up being locked out of a remote server due to too many failed tries based on SSH keys/identities since the server access was based on a password and SSH keys/identities are SSH keys/identities. So the SSH agent tried all of my SSH keys, failed and I couldn’t even get to the password prompt.

The problem is that ssh-add -A will just arbitrarily add every single SSH key/identity you have to the agent even if it’s not necessary to do so; such as in the case of Vagrant boxes.

My solution after much testing was as follows.

First, if you have more SSH keys/identities added to your agent than you need—as shown with ssh-add -l then purge them all from the agent like so:

ssh-add -D

With that done, then start the SSH agent as a background process like so:

eval "$(ssh-agent -s)"

Now, it gets weird and I am not too sure why. In some cases you can specifically add the ~/.ssh/id_rsa key/identity to the agent like so:

ssh-add ~/.ssh/id_rsa

Type in your passphrase, hit Return and you should be good to go.

But in other cases simply running this is enough to get the key/identity added:

ssh-add -K

If that’s all worked, type in ssh-add -l and you should see one lone SSH key/identity listed.

All good? Now open up your .bash_profile:

nano ~/.bash_profile

And add this line to the bottom; comment or remove the -A version if you have that in place:

ssh-add -K 2>/dev/null;

That will allow the SSH key/identity to be reloaded to the SSH agent on each startup/reboot.

UPDATE: Apple has now added a UseKeychain option to the open SSH config options and considers ssh-add -A a solution as well.

As of macOS Sierra 10.12.2, Apple has added a UseKeychain config option for SSH configs. Checking the man page (via man ssh_config) shows the following info:

        On macOS, specifies whether the system should search for
        passphrases in the user's keychain when attempting to use a par-
        ticular key. When the passphrase is provided by the user, this
        option also specifies whether the passphrase should be stored
        into the keychain once it has been verified to be correct.  The
        argument must be ``yes'' or ``no''.  The default is ``no''.

Which boils down to Apple seeing the solution as either adding ssh-add -A to your .bash_profile as explained in this Open Radar ticket or adding UseKeychain as one of the options in a per user ~/.ssh/config.

  • 4
    @modius: if you have a pw protected key, do ssh-add -K [path to key] and enter pw when prompted. Keychain will store password and ssh-add will get it from there after that.
    – Timo
    Commented Oct 3, 2016 at 7:32
  • 4
    Note the -A is for adding identities to the agent using any passphrases stored in your keychain. If you additionally have identities without passphrases, you will need to omit the -A option to add them to your agent.
    – Evan Pon
    Commented Oct 12, 2016 at 16:57
  • 12
    Just to add a bit more visibility to this, Apple has update the man page for ssh_config to include UseKeychain and AddKeysToAgent to automatically add your keys from your ssh_config. No shell scripting needed. See @mluisbrown answer below for the updated info for 10.12.2 Commented Dec 15, 2016 at 22:47
  • 1
    @JakeGould I get what you are saying, I actually like what they are doing. Instead of automatically saving the passphrase to the Keychain and loading it on boot, they are giving you control of your security. /shrug Commented Dec 16, 2016 at 21:47
  • 1
    LOL, thanks for that - So they add in ssh_config options to handle this automatically but don't recommend using them. Commented Dec 20, 2016 at 12:41

As explained here, this is the recommended method since macOS 10.12.2:

  1. Add the following lines to your ~/.ssh/config file:

    Host *
        UseKeychain yes
        AddKeysToAgent yes
  2. Any key you add to the ssh-agent using the ssh-add /path/to/your/private/key/id_rsa command will be automatically added to the keychain, and should be autoloaded upon reboot.

I'm adding this answer because:

  • Other answers tell you to add the IdentityFile ~/.ssh/id_rsa line, but that option is not needed for autoloading the keys (and it'll actually bind that particular key for the host section your add it to, which you won't want if you use different keys for different hots).
  • The accepted answer mentions UseKeychain, but that is not enough to persist the keys in ssh-agent after a reboot.
  • 3
    Regarding second point. Just how sure are you? Nothing actually happens upon reboot and it is not mentioned in your reference material either. What does happen with the above config is that your SSH client will load the key into agent upon first connection (and it will also fetch the passphrase from keychain), then the key will stay loaded. You can verify this statement by listing the keys right after reboot via ssh-add -L and it will report The agent has no identities. Nothing will be there until you connect. The AddKeysToAgent does not persist keys between reboots in any way! Commented Jan 10, 2019 at 21:52

I've written a short post about this topic that might help you.

A solution is calling ssh-add -A command on every startup.

Just add .plist file with the following content to the path ~/Library/LaunchAgents/ or create one with Lingon app:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

<!-- @@@@LingonWhatStart:ssh-add -A@@@@LingonWhatEnd -->

Since macOS 10.12.2 you can use the UseKeychain option. Read more here or look into man ssh_config.

         On macOS, specifies whether the system should search for passphrases in the user's keychain
         when attempting to use a particular key. When the passphrase is provided by the user, this
         option also specifies whether the passphrase should be stored into the keychain once it has
         been verified to be correct.  The argument must be ``yes'' or ``no''.  The default is ``no''.

So just do the following:

echo "UseKeychain yes" >> ~/.ssh/config

  • 1
    Using >> is at risk if you input the command multiple times. Better do a manual edition of the file, as described by mluisbrown answer or ChrisJF answer.
    – Cœur
    Commented Feb 3, 2017 at 2:37
  • You are right there :-)
    – Ben
    Commented Feb 4, 2017 at 19:53

I had this problem before and I've found a way to bypass this. I just created a file named config in my ~/.ssh folder, where I've added the following lines:

Host github.com
HostName github.com
IdentityFile ~/.ssh/github
IdentitiesOnly yes

I am not sure why, but Host and HostName both are important. In my case if one of them was not present then the solution didn't work.

Then, I just did an ssh-add -K and it was working even after the restart.

  • 3
    Host is your user-defined name/alias for a particular server and demarcates entries per server: stylistically it's nice to indent the lines that follow the Host entry. HostName indicates the server's network addressable name like github.com, but you could use an IP address too. Host and HostName don't have to be the same thing, but yes, they are both integral to the ssh config format.
    – Mark Fox
    Commented Dec 13, 2016 at 0:35

If you are using a different version of ssh (e.g. installed via homebrew) the above solutions will not work out of the box. For instance, AddKeysToAgent yes and UseKeychain yes in the .ssh/config file are not recognized by non-Apple ssh versions and will cause an error. The same for the -A or -K option for the ssh client.

That means @mluisbrown's answer will not work at all. You can use method 1 of @Giacomo1968's answer and explicitly use the macOS ssh-add utility in your .bash_profile to add all keys to the keychain, i.e.:

/usr/bin/ssh-add -A

As mentioned by a comment above, you may have to add a key to the keychain first: e.g. /usr/bin/ssh-add -K .ssh/github


I found that ssh-add -K gave me "illegal option -- K". This was because ssh-add was a strange version coming from /usr/local/bin (installed by brew?). I was able to add the key by specific use of the ssh-add located in /usr/bin:

/usr/bin/ssh-add -K ~/.ssh/id_rsa
  • this is what worked fro me after failing to work easily for ages.
    – nyxee
    Commented Oct 4, 2019 at 13:35

I updated to Mac OS X Sierra (10.12.6). I could ssh into other hosts but not into github.com.

This is what I had to insert into ~/.ssh/config:

PubkeyAcceptedKeyTypes ssh-dss,ssh-rsa

After that change, I could use github as before.

  • This finally solved all my SSH problems on Mac OS 13.3 when trying to connect to a Hostgator server (after using ssh-copy-id to copy the id to the server).
    – Magnus
    Commented May 23, 2023 at 8:54

Amending ~/.ssh/config to add UseKeyChain for all hosts is enough to stop this recurring nightmare ;)

Host *
 UseKeychain yes

If the file is empty or doesn't exist simple create and/or add the above configuration.

  • Could you explain how this works. for example when ssh-add is run or on reboot. what actually happens? Commented Dec 20, 2022 at 7:33

There is a similar question answered in this thread on Askubuntu. I found a great solution for that by adding a plugin for oh-my-zsh shell that I switched to from bash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .