SSH Agent vs Raw Keys: When to Use Each (and When Not To)

SSH gives you two ways to authenticate:

• raw private keys
• SSH agent

They are not interchangeable.

What SSH agent is

SSH agent is:

A background process that holds private keys in memory

It signs authentication requests without exposing key files.

Raw keys (direct usage)

ssh -i ~/.ssh/key user@server

Simple and explicit.

Best for:

• CI/CD
• automation
• servers

SSH agent usage

ssh-add ~/.ssh/key
ssh user@server

Best for:

• local development
• frequent access
• passphrase-protected keys

Why CI/CD should NOT use agent

• agents require interactive sessions
• runners are ephemeral
• keys must be explicit

Use raw keys in automation.

Security tradeoffs

Choose based on context.

Final rule

Humans → SSH agent
Automation → raw keys

Never mix them.