I got a new job, they use GitHub for version control. Great I figured, just like every place I've worked at before them, except not.

They told me in an email that they need my public key so I could get access to the company repository. This has me confused since every other employer only needed my username to shoot me an invite and afaik there is no such thing as a github public key.

I can only imagine that its the SSH key that they mean? I've never used that feature but AFAIK I can use it to log into my account and do stuff, why the hell would they need to do that?

Now its a legitimate company with a history stretching back over 20 years so I'm thinking I'm missing something here, can someone elaborate?

  • 11
    I think you aren't getting the purpose of a public key. When you generate keys for SSH, you generate a private and public key pair. The private one is essentially your password and the public one is used to verify your identity from a signature. They probably have an enterprise GitHub and their server will need to verify it's you. – Chan-Ho Suh Sep 14 '19 at 22:56
  • 11
    I'm voting to close this question as off-topic because this is best answered by Github's help article on the topic. – rath Sep 14 '19 at 23:21
  • A little search goes a long way... why use public key on GitHub leads to Connecting to GitHub with SSH. – user25792 Sep 15 '19 at 20:30
  • Are you supposed to use your private account to commit to a company repository? – Bernhard Döbler Sep 16 '19 at 20:16
  • I've not added my "close" vote yet, but I will be doing that shortly as well. A "public key" is intended to be "public". They can be plastered on subway walls and not affect the security of anything. – Julie in Austin Sep 17 '19 at 18:40

The way github is supposed to work is you have an account for each person. Those personal accounts can then be associated with organization accounts. You can access the repositories over https using either your account password or using an API token you generate on the github website.

You can also access the repository over ssh, to do this you generate a ssh key pair and then register your ssh key on github's site as allowed to access your account.

My guess is that they are using a single github "person account" for multiple people, and are asking for your ssh public key so they can add it to the list of ssh keys authorized for that account.

Not the answer you're looking for? Browse other questions tagged or ask your own question.