Permission Denied (publickey)

Symptom

Warning: Permanently added 'ssh.<INSTANCE>.git.eu' (ED25519) to the list of known hosts.
Authorized use only. All connections are logged and monitored.
git@ssh.<INSTANCE>.git.eu: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

The Warning: Permanently added line appears on the first connection only. The Authorized use only banner is normal.

Cause

The server accepted none of the keys your ssh client offered:

• the public key is not registered on your account;
• you registered another key than the one on this machine;
• the ssh client offers other keys and not the registered one (several keys in the agent, a key outside ~/.ssh);
• the key was deleted from your account.

Diagnose

1. List the keys the ssh agent offers:

ssh-add -l

2. Print the fingerprint of your public key, and compare it with the one shown in Settings → Git Access → SSH Keys:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

3. Watch which keys the client offers (the Offering public key lines). Use the SSH host from your clone URL, the part between git@ and ::

GIT_SSH_COMMAND="ssh -v" git ls-remote git@ssh.<INSTANCE>.git.eu:<USERNAME>/<REPO>.git

Fix

Option A - Register the public key (recommended)

Copy the full line of the public file and add it in Settings → Git Access → SSH Keys:

cat ~/.ssh/id_ed25519.pub

Option B - Tell ssh which key to use

Add a block to ~/.ssh/config so the client offers the registered key only:

Host ssh.<INSTANCE>.git.eu
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Verify

git ls-remote git@ssh.<INSTANCE>.git.eu:<USERNAME>/<REPO>.git

It lists the branches and tags, with no Permission denied line.

Prevent

• Register one key per device, named after the device.
• Delete the key of a lost or retired device from your settings.

Related

• Key Not Accepted
• Repository Not Found
• Access over SSH
• Knowledge Base - SSH