--- title: Open-sourcing OpenPubkey SSH (OPKSSH): integrating... description: OPKSSH, a tool that lets users SSH into servers using single sign-on (OpenID Connect) instead of managing long-lived SSH keys, has been open-sourced under the... canonical: https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH | daily.dev og:description: OPKSSH, a tool that lets users SSH into servers using single sign-on (OpenID Connect) instead of managing long-lived SSH keys, has been open-sourced under the... og:url: https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v og:image: https://api.daily.dev/og/posts/6vbVavl7v.png og:image:alt: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH **[Lobsters](https://daily.dev/sources/lobsters)** · 9 min read · 28 upvotes · 0 comments ## Summary OPKSSH, a tool that lets users SSH into servers using single sign-on (OpenID Connect) instead of managing long-lived SSH keys, has been open-sourced under the OpenPubkey project. Cloudflare, which acquired the code via its BastionZero acquisition, donated it to the project under the Apache 2.0 license. OPKSSH works by embedding an OpenID ID Token (extended with a public key via the OpenPubkey protocol) into an SSH certificate extension field, requiring no changes to SSH client or server code beyond a two-line sshd_config change using AuthorizedKeysCommand. This replaces static SSH keys with ephemeral, expiring keys tied to identity (e.g., email addresses) rather than raw public keys, improving security, usability, and access visibility. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What license is OPKSSH released under and who open-sourced it? OPKSSH was open-sourced under the Apache 2.0 license and released as openpubkey/opkssh on GitHub. It was previously closed-source software owned by BastionZero, which Cloudflare acquired; Cloudflare then donated the code to the OpenPubkey project, an open source Linux Foundation project since 2023. Cloudflare does not endorse OPKSSH but simply donated the code. _Teams evaluating SSO based SSH tooling can track releases like this one on daily.dev._ ### How does OPKSSH authenticate SSH logins without modifying the SSH protocol? OPKSSH packages an OpenID Connect PK Token, an ID token extended with a public key, into an SSH certificate's extension field so it travels inside the normal SSH public key exchange. The SSH server is configured with a two-line sshd_config change using AuthorizedKeysCommand to call the opkssh verify program, which checks the token's validity, signature, and matching public key before allowing access. _Developers wiring SSO into SSH can compare implementation approaches like this via daily.dev._ ### How often do OPKSSH generated SSH keys expire by default? OPKSSH generated ephemeral SSH keys expire every 24 hours by default, though the expiration policy can be adjusted in a configuration file. This replaces traditional long-lived SSH keys, reducing the window in which a compromised private key could be misused, since users simply run opkssh login to sign in again via their identity provider. _Ops engineers hardening SSH access can keep tabs on tools like this through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 3 discussions and 16 comments across lobsters, hackernews (as of 2026-09-14). **TL;DR:** Technically curious commenters find the OIDC-to-SSH-certificate trick clever and low-friction, with the discussion mostly focused on documentation typos and implementation details rather than fundamental objections. **Sentiment:** 50% positive · 40% mixed · 10% skeptical **The case for** - The trick of binding a key to an OIDC token via a partially non-random nonce is seen as clever and generalizable. - Smuggling OIDC data through an SSH certificate extension field is viewed as a low-pain way to add OIDC/MFA-backed authentication to SSH without needing a full SSH CA. - Self-hosted identity providers (e.g. authentik) can be used, addressing concerns about third-party IdP dependence. **The pushback** - The presence of a third-party IdP requirement could deter enterprise and homelab users who prefer self-contained identity providers. - Documentation diagrams contained typos and a duplicated/incorrect image, which was called mildly confidence-waning. **By community** - lobsters (positive): Focused mostly on appreciating the clever OIDC/SSH-certificate trick and fixing documentation typos, with the author actively engaging. - hackernews (mixed): One commenter raised concerns about third-party IdP dependence while the author clarified self-hosted IdPs work fine. **Open questions** - Whether the OpenPubkey feature that removes trust in the IdP will ever be ported to OPKSSH. **Highlights** > OpenPubkey and OPKSSH have some nifty and clever ideas. OPK lets a client bind a key to an OIDC token by making the client-supplied OIDC token nonce partially non-random, which is a neat idea that generalizes to any sufficiently large client-supplied nonce. OPKSSH itself smuggles the OIDC information from the client to the server through a SSH key certificate extension (on the server it goes through sshd's AuthorizedKeysCommand to recover the key bound to and verified by the OPK OIDC token). On the client, you can even load the 'SSH key certificate' that OPKSSH generates into your SSH agent. (The OPKSSH SSH key certificate doesn't require you to have a SSH CA, because it's never used directly for authentication; it's only used to pass essentially arbitrary data from the SSH client to the SSH server during SSH authentication. Other uses of this general trick with SSH certificates are certainly possible.) The whole thing is a reasonably low-pain, low additional software way to go from having an OIDC identity server to using OIDC identities to authenticate SSH connections. If you have MFA hooked up to your OIDC IdP, it's also a mostly-painless way to get convenient MFA authenticated SSH connections. The nominal proper way is to use full proper SSH certificates with a SSH CA and have that SSH CA give out time limited SSH certificates to people who've authenticated to it with OIDC, but then you need the SSH CA software and etc etc. (This is an area of interest to me for reasons™ and I've been playing around with opkssh for a while.) > — [cks on lobsters · 7 points, 1 comments](https://lobste.rs/s/n7kpm6/open_sourcing_openpubkey_ssh_opkssh#c_k20tte) > Disclaimer: I code-review OpenSSH yearly. Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server. But then again, I could be wrong. Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users. And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server. Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that. https://egbert.net/blog/articles/ssh-openssh-certificates.ht... > — [egberts1 on hackernews · 1 comments](https://news.ycombinator.com/item?id=49133598) > You can use a self-hosted identity provider with OPKSSH. OPKSSH is just the protocol and the software that plugs an identity provider into SSH. Lots of people use it with authentik instances they run themselves. > Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users. SSH certificates are fantastic. OPKSSH wouldn't work without them. > And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server. Will check it out. > — [EthanHeilman on hackernews](https://news.ycombinator.com/item?id=49145284) > Also, the two diagrams under "OpenID Connect" and "OpenPubkey" are identical - they have different urls but are the exact same image. I presume the OpenPubkey one is the wrong one. (edited to add - it is. The bottom of the article links to the original blog, which has the correct 2nd image https://blog.cloudflare.com/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh/ ) And there's another typo in How it works - "lice runs opkssh login" - that sounds like a bug ;) (should be "Alice") > — [bazzargh on lobsters · 3 points, 1 comments](https://lobste.rs/s/n7kpm6/open_sourcing_openpubkey_ssh_opkssh#c_1dpdve) > You said this [on HN](https://news.ycombinator.com/item?id=43473554): > While not available in opkssh yet, OpenPubkey even has a way of removing the trust assumption in your IDP. Did this ever become a thing? > — [winter on lobsters · 2 points, 1 comments](https://lobste.rs/s/n7kpm6/open_sourcing_openpubkey_ssh_opkssh#c_wkjavb) **Source threads** - [lobsters](https://lobste.rs/s/n7kpm6/open_sourcing_openpubkey_ssh_opkssh) · 16 points · 12 comments - [hackernews](https://news.ycombinator.com/item?id=49123867) · 10 points · 4 comments - [hackernews](https://news.ycombinator.com/item?id=49389191) · 1 points · 0 comments ## Similar posts on daily.dev - [KeyleSSH: A New PAM Concept for IT Admins](https://daily.dev/posts/keylessh-a-new-pam-concept-for-it-admins-rzublwcua) · ITNEXT · 0 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments - [OpenSSH: Release Notes](https://daily.dev/posts/openssh-release-notes-iatm6rseu) · Lobsters · 2 upvotes · 0 comments - [OpenSSH 10.4 released](https://daily.dev/posts/openssh-10-4-released-hvdxib33z) · LWN.net · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#authentication](https://daily.dev/tags/authentication), [#cloudflare](https://daily.dev/tags/cloudflare), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH","url":"https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v"},"datePublished":"2026-08-21T15:46:08.495Z","dateModified":"2026-09-14T08:37:30.760Z","description":"OPKSSH, a tool that lets users SSH into servers using single sign-on (OpenID Connect) instead of managing long-lived SSH keys, has been open-sourced under the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d681a6fd243f9cd7f61a992e7eafc93?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d681a6fd243f9cd7f61a992e7eafc93?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":28},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,authentication,cloudflare,ssh","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with-ssh-6vbvavl7v#faq","mainEntity":[{"@type":"Question","name":"What license is OPKSSH released under and who open-sourced it?","acceptedAnswer":{"@type":"Answer","text":"OPKSSH was open-sourced under the Apache 2.0 license and released as openpubkey/opkssh on GitHub. It was previously closed-source software owned by BastionZero, which Cloudflare acquired; Cloudflare then donated the code to the OpenPubkey project, an open source Linux Foundation project since 2023. Cloudflare does not endorse OPKSSH but simply donated the code. Teams evaluating SSO based SSH tooling can track releases like this one on daily.dev."}},{"@type":"Question","name":"How does OPKSSH authenticate SSH logins without modifying the SSH protocol?","acceptedAnswer":{"@type":"Answer","text":"OPKSSH packages an OpenID Connect PK Token, an ID token extended with a public key, into an SSH certificate's extension field so it travels inside the normal SSH public key exchange. The SSH server is configured with a two-line sshd_config change using AuthorizedKeysCommand to call the opkssh verify program, which checks the token's validity, signature, and matching public key before allowing access. Developers wiring SSO into SSH can compare implementation approaches like this via daily.dev."}},{"@type":"Question","name":"How often do OPKSSH generated SSH keys expire by default?","acceptedAnswer":{"@type":"Answer","text":"OPKSSH generated ephemeral SSH keys expire every 24 hours by default, though the expiration policy can be adjusted in a configuration file. This replaces traditional long-lived SSH keys, reducing the window in which a compromised private key could be misused, since users simply run opkssh login to sign in again via their identity provider. Ops engineers hardening SSH access can keep tabs on tools like this through daily.dev."}}]} ```