Keychain

What each field, switch and setting does, 53 controls in all on this page. This is the text behind the ⓘ beside each label in the apps: hover or click it on the desktop (or press F1 in the field), tap it on the phone.

The line under each name gives the id the code uses for it, and says when only one of the apps has it.

Identity

Where: Keychain › Identities › New identity.

Label

identity.label

What you call this identity in the list. An identity is a login (user name, password, key) saved once and reused by many hosts.

• Example: deploy@production

Username

identity.username

The account name on the servers that use this identity.

• Example: deploy

Password

identity.password · also shown as “New password”

The password of that account, if it logs in with one. Leave it empty for a key-only login. On desktop a saved password is never shown again: leave the field empty to keep it, or type a new one to replace it.

• Default: None.
• Caution: It is stored in the vault and syncs with it, unless Settings › Security › “Sync keys and identities” is off.

Remove the saved password

identity.removePassword · Desktop only

Deletes the password saved with this identity when you save. Hosts using the identity then log in with its key, or ask for a password.

• Default: Off.

Key

identity.key · also shown as “Key (optional)”

The private key this identity logs in with. Only keys of the same vault are offered.

• Default: No key.

Generate a key

Where: Keychain › Keys › Generate.

Type

keygen.type · also shown as “Key type”

The kind of key pair to make. Ed25519 is short, fast and accepted by every current server. Choose ECDSA or RSA only for a server that demands it. The “security key” types keep the private half on a hardware security key (a FIDO2 key such as a YubiKey or SoloKey: plugged into USB, or on a phone also held to its back over NFC), which has to be present to log in. Every FIDO2 key can make ECDSA; most newer ones also Ed25519.

• Default: Ed25519.
• More: Read more

Size

keygen.bits · Desktop only

The length of an RSA or ECDSA key in bits. Longer is stronger and slower. RSA: 2048, 3072 or 4096. ECDSA: 256, 384 or 521.

• Default: RSA 4096, ECDSA 256.

Application

keygen.application

The name a security key files this credential under. It must start with “ssh:”. Change it only to keep several SSH keys apart on one security key.

• Default: ssh:
• Example: ssh:work

Require a touch for every login

keygen.requireTouch

You must touch the security key each time it logs in, which proves a person is there. Turning it off lets it sign silently.

• Default: On.
• Caution: With it off, the server must also allow that (the option no-touch-required on that key’s line in the server’s authorized_keys file), and nothing proves a person was present.

Require the security key’s PIN or biometric

keygen.verifyRequired

Every login also needs the security key’s PIN or fingerprint, not just a touch. Use it for a key that would be dangerous if stolen with the device.

• Default: Off.

Security key PIN

keygen.pin

The PIN of the security key, needed to create the credential when the key has one. It is used once and not saved.

• Default: Empty.

Store the key on the security key

keygen.resident

Keeps the key on the security key itself (a “resident” or “discoverable” key), so you can load it into Sternway on another computer or phone with Import from security key, or with ssh-keygen -K. Needs a security key with a PIN.

• Default: Off: the key file stays in this keychain and only works with the same security key.
• Caution: Anyone who has the security key and knows its PIN can load the key.
• More: Read more

User name on the security key

keygen.user

A name the security key files a stored key under, so one key can hold several SSH keys for the same application. A stored key with the same application and user name replaces the one before it. At most 32 bytes.

• Default: Empty.
• Example: ada

Label

keygen.label

What you call this key in the list. Required, up to 256 characters.

• Example: Laptop 2026

Comment

keygen.comment

A note stored inside the public key. It shows in a server’s authorized_keys file, so an administrator can tell whose key it is.

• Default: Empty on desktop; “sternway-mobile” on mobile.
• Example: ada@laptop

Passphrase

keygen.passphrase · also shown as “Passphrase (optional)”

A password that encrypts the private key itself. You are asked for it each time the key is used; it is not saved. Leave it empty for a key that works without asking.

• Default: None.
• Caution: There is no second field to confirm it and no way to recover it: a mistyped or forgotten passphrase makes the key useless.

Import a key

Where: Keychain › Keys › Import.

Private key

keyImport.privateKey · also shown as “Paste the private key”

An existing private key, chosen as a file or pasted whole, including its BEGIN and END lines. OpenSSH, PEM (PKCS#1, PKCS#8, SEC1) and PuTTY .ppk files are accepted; a .ppk is converted to OpenSSH. A .pub file chosen with it must be the matching public half.

• Caution: A private key lets anyone holding it log in as you. Import only your own, and delete stray copies afterwards.

Passphrase

keyImport.passphrase · also shown as “Passphrase (if encrypted)”

The passphrase of the key being imported, needed only when the key is encrypted. It is used to read the key.

• Caution: Desktop does not keep it and asks again when the key is used. Mobile saves it with the key on the device, so the key then works without asking.

Label

keyImport.label

What you call this key in the list. Left empty, it takes the key’s comment, then the file name.

Import from security key

Where: Keychain › Keys › Import from security key.

Security key PIN

keyLoad.pin

The PIN of the security key. Reading the keys stored on it always needs it. It is used once and not saved.

• Caution: A few wrong PINs in a row lock the security key; a locked PIN can only be reset, which erases the keys stored on it.
• More: Read more

Passphrase for the key files

keyLoad.passphrase

Optional. Encrypts the key files Sternway saves for the loaded keys; you are then asked for it at each login, as well as for the touch.

• Default: None.

Keys: export, rename, install, hardware

Where: Keychain › a key.

Passphrase for the file (optional)

keyExport.passphrase

Encrypts the exported copy with this passphrase; the key kept in the app is not changed. Offered only for a key that has no passphrase of its own.

• Default: None: the exported file is not encrypted.
• Caution: Without a passphrase, anyone who gets the file can log in as you.

Confirm passphrase

keyExport.passphraseConfirm

Type the same passphrase again, to catch a typo before the file is written.

Name

key.rename · also shown as “Label”

What you call this key in the list. Renaming changes nothing on servers.

Label

hwKey.label · Desktop only

What you call this hardware key in the list. Its private half is created in this computer’s secure hardware and can never be copied out, synced or exported.

Ask for confirmation on every use

hwKey.requirePresence · Desktop only

The computer asks for your fingerprint, face or PIN each time the key logs in.

• Default: On.

Key

keyInstall.key

The key whose public half is added to the server’s list of accepted keys (the authorized_keys file of the account you log in as), so that account accepts this key from then on. The private half never leaves this device. A key that is already in the list is not added twice.

Hosts

keyInstall.hosts

The servers to add the key to. The app logs in to each the usual way, creates ~/.ssh and authorized_keys when missing, and appends one line. Nothing already in the file is changed, and a key already there is left alone.

Certificate

Where: Keychain › Certificates › Attach certificate.

Certificate

cert.certificate

An SSH certificate is a public key signed by your organisation’s certificate authority; servers that trust the authority accept it without the key being installed on each. Paste the contents of the …-cert.pub file and its details are read for you.

• Example: ssh-ed25519-cert-v01@openssh.com AAAA…

Key

cert.key

The private key this certificate was issued for. The key matching the certificate is chosen for you when it is in the Keychain.

Type

cert.type · Desktop only

A user certificate signs you in to servers; a host certificate identifies a server. Read from the certificate; change it only when the certificate could not be read.

• Default: User.

Principals

cert.principals · Desktop only

The account names the certificate is valid for (OpenSSH calls them principals), separated by commas. A server accepts the certificate only for an account named here. Read from the certificate.

• Example: deploy, ubuntu

Valid after

cert.validAfter · Desktop only

The moment the certificate starts to work, in your local time. Empty means it has no start. A certificate is offered when you connect only while it is valid.

Valid before

cert.validBefore · Desktop only

The moment the certificate expires, in your local time. Empty means it never does. After this, servers refuse it and you need a new one.

Serial

cert.serial · Desktop only

The number the certificate authority gave this certificate, read from the certificate itself. It is what the authority’s administrator needs to find or revoke this certificate, so quote it when you ask about one.

Key ID

cert.keyIdField · Desktop only

The name the certificate authority wrote into the certificate, which servers put in their logs. Read from the certificate.

CA fingerprint (SHA256)

cert.caFingerprint · Desktop only

The fingerprint of the authority that signed the certificate, so you can check it is the one you expect. Read from the certificate.

Certificate authority

Where: Keychain › a key › Certificate authority.

Longest certificate (hours)

ca.maxValidity · Desktop only

Makes this key a certificate authority (CA) that signs SSH certificates for other keys, here on this device: its private key stays encrypted in your vault and is never sent to a server. This is the longest a certificate it signs may last; each certificate can be shorter.

• Default: 168 hours (7 days); at most 8784 (366 days).
• Caution: Anyone who can use this key can let anyone log in where the CA is trusted: keep it in a vault only the right people can open. In a shared vault, every member who can edit it can sign with it. A key that hosts log in with cannot be a CA, and a CA key is never put in a forwarded agent.

Key to certify

caSign.subject · Desktop only

The key the certificate is for. The certificate is saved with that key, and logging in with the key presents it from then on.

Certificate for

caSign.type · Desktop only

A user certificate logs a person in to servers that trust this CA (TrustedUserCAKeys). A host certificate tells clients that a server is the one it says it is (@cert-authority in known_hosts).

• Default: User.

Principals

caSign.principals · Desktop only

For a user certificate, the accounts it may log in as; for a host certificate, the names of the server. Separate them with commas or spaces.

• Example: deploy, ubuntu
• Caution: At least one. A principal has no spaces, commas, control characters or bidirectional-text controls.

Valid for (hours)

caSign.validity · Desktop only

How long the certificate works, from a minute before it is signed (for a server whose clock is a little behind). Short certificates need no revoking: they simply run out.

• Default: 8 hours; at most the CA’s longest certificate.

Key ID

caSign.keyId · Desktop only

A name written into the certificate, which servers put in their logs when it is used.

• Default: The name of the key it is for.
• Caution: No control characters or bidirectional-text controls: they would change how the servers’ logs read.

Forced command

caSign.forceCommand · Desktop only

When set, a login with this certificate runs only this command, whatever was asked for (OpenSSH force-command). For a user certificate only.

• Default: None: any command.
• Example: /usr/local/bin/backup –run

Allowed from

caSign.sourceAddress · Desktop only

When set, the certificate works only from these IP addresses or CIDR ranges, separated by commas (OpenSSH source-address). For a user certificate only.

• Default: Empty: from anywhere.
• Example: 10.0.0.0/8,192.168.1.7
• Caution: A range is its network address and mask (10.0.0.0/8, not 10.0.0.1/8): servers refuse a range with bits set past its mask.

Allows

caSign.extensions · Desktop only

What a session with this certificate may do: a terminal (pty), port forwarding, agent forwarding, X11 forwarding and the user’s ~/.ssh/rc. Untick what the certificate should not allow. For a user certificate only.

• Default: All five, as ssh-keygen gives.

CA key passphrase

caSign.passphrase · Desktop only

This CA key is encrypted and its passphrase is not saved: type it to sign. It is used for this certificate only and not kept.

Hosts it vouches for

caTrust.hostPattern · Desktop only

The host names whose host certificates from this CA are trusted, as in known_hosts: wildcards and comma-separated lists. A host that shows a certificate this CA signed for its name is then known without asking.

• Example: *.example.com
• Caution: Trust a CA only for names it should vouch for: it can then speak for every host the pattern covers. In a shared vault, * alone is refused.

Step CA

Where: Keychain › a key › Step CA.

CA address

stepCa.url · Desktop only

The address of your step-ca server, where this key gets short-lived SSH certificates. Only https is used (plain http only to this computer). Each answer the CA gives is read up to 1 MiB.

• Example: https://ca.example.com
• Caution: On a key in a vault others can change, these settings decide where your sign-in goes: the app asks before this device first uses them, and after any change.

Root fingerprint

stepCa.rootFingerprint · Desktop only

The SHA-256 fingerprint of the CA’s root certificate, as step certificate fingerprint root_ca.crt prints it. The app trusts this root alone for the CA: a server with another root is refused before anything is sent.

• Caution: Get it from your CA’s administrator over a channel you trust, not from the CA itself.

Provisioner

stepCa.provisioner · Desktop only

How the CA checks it is you: a JWK provisioner asks for its password; an OIDC provisioner opens your identity provider in the browser. Load the list from the CA, then choose.

Principals

stepCa.principals · Desktop only

The accounts to ask the CA for, separated by commas or spaces. The CA decides which it grants.

• Example: deploy

Provisioner password

stepCa.password · Desktop only

The password of the JWK provisioner. It opens the provisioner key the CA hands out encrypted, here on this device, to sign the request; it is used for this certificate only and never saved or sent.

• Caution: Whoever has this password can ask the CA for a certificate for any principal the provisioner allows, on any key: on a team key, share it only with those who may.