Using Multiple GitHub Deploy Keys Safely in Production

Deploy keys are powerful — and dangerous if misused.

This guide explains how to use multiple deploy keys safely without breaking security boundaries.

What deploy keys are (quick recap)

Deploy keys allow:

• A server to pull from a private repo
• Without exposing user credentials

They are repository-scoped, not account-scoped.

Why you should use multiple deploy keys

Different servers have different trust levels:

• production
• staging
• backup

One leaked key should not expose everything.

Correct pattern

Server A → Key A → Repo
Server B → Key B → Repo

Each server gets:

• its own SSH key
• read-only access

How to manage multiple keys

On each server:

ssh-keygen -t ed25519 -f ~/.ssh/repo_key

On GitHub:

• Add each public key as a deploy key
• Label clearly: prod-server, staging-server

Never do this

❌ Reuse personal SSH keys
❌ Share one deploy key across servers
❌ Give write access unless required

SSH config makes this clean

Host github.com
  IdentityFile ~/.ssh/repo_key

No flags. No mistakes.

Final thought

Deploy keys are server identities.

Treat them like credentials — not shortcuts.