---
title: Use public-key sign-in
description: Register an Ed25519 public key while keeping the private key in
  your own system.
editUrl: true
head: []
template: doc
sidebar:
  order: 3
  hidden: false
  attrs: {}
pagefind: true
draft: false
---

Public-key sign-in is a good fit for a service that already has reliable key storage and signing support. You generate an Ed25519 key pair in your own system and register only the public half with Sudomimus. The private key stays with you.

If you mainly want the quickest setup, an [access key](/en-us/programmatic-access/access-keys/) is usually easier.

## Generate a key pair in the portal

The With portal can generate the key pair on macOS, Windows, and Linux:

1. Open **Programmatic access → Public keys**, then select **Create**.
2. Select **Generate key pair on this device**.
3. Download and store the private-key file. The portal enables saving only after the download.
4. The public JWK is filled in automatically.

Generation happens in the current browser. Only the public key is submitted to Sudomimus.

## Generate a key pair from the command line

If OpenSSL is installed, generate an Ed25519 private key and its matching SPKI public-key PEM directly:

### macOS and Linux

Run this in Terminal:

```bash
openssl genpkey -algorithm Ed25519 -out sudomimus-ed25519.private.pem
openssl pkey -in sudomimus-ed25519.private.pem -pubout -out sudomimus-ed25519.public.pem
chmod 600 sudomimus-ed25519.private.pem
```

### Windows

Run this in PowerShell:

```powershell
openssl genpkey -algorithm Ed25519 -out sudomimus-ed25519.private.pem
openssl pkey -in sudomimus-ed25519.private.pem -pubout -out sudomimus-ed25519.public.pem
```

These commands create private- and public-key PEM files. Paste the contents of `sudomimus-ed25519.public.pem` into the With portal; the portal converts it to the public JWK used by Sudomimus in the current browser. Place the private-key file in the service that will use it, and never paste or upload the private key.

The portal also continues to accept an existing exact Ed25519 public JWK `{ "kty": "OKP", "crv": "Ed25519", "x": "..." }`.

## Register a public key

Prepare the application or sector anchors the key should cover. Then, in [`with.sudomimus.com`](https://with.sudomimus.com):

1. Open **Programmatic access → Public keys**.
2. Select **Create** and enter a name that identifies its purpose.
3. Choose your account, an agent, or an automation as the principal.
4. Generate a key pair on the current device or paste an existing Ed25519 public-key PEM/JWK. Never paste the private key.
5. Enter the application or sector anchors that may use the key, and add an expiry if needed.
6. Save the key, then configure the service to sign in with the matching private key.

The target application must support public-key sign-in. The application developer or organization administrator provides the required application or sector anchors.

## Application and sector coverage

- An **application anchor** limits the key to that application.
- A **sector anchor** covers applications in that sector, including applications added later.

Coverage determines where the key may be used to sign in. It does not grant permissions inside those applications. Coverage cannot be edited after registration. To change it, register a replacement, switch the service, and revoke the old key.

## Storage and rotation

- Keep the private key in an operating-system keychain, hardware security device, or protected key service.
- Never paste it into the With portal, a chat, a ticket, or a source repository.
- Use separate keys for separate environments so a test-system leak does not affect production.
- If the private key is lost or may have leaked, revoke the public key entry and register a replacement immediately.

## Related

- [Choose a programmatic access method](/en-us/programmatic-access/overview/)
- [Manage access keys](/en-us/programmatic-access/access-keys/)
- [Agents](/en-us/programmatic-access/agents/) and [automations](/en-us/programmatic-access/automations/)