How does SSH public-key injection work when creating a VPS?
A supported provisioning system can place a supplied public key into the initial guest account’s authorised-key configuration. Only the public key is supplied. The private key remains with the authorised administrator and is used later to prove identity.
Instructions
1. Prepare the public identity
Generate or select the approved local key and record its public fingerprint.
ssh-keygen -lf "$env:USERPROFILE\.ssh\server_ed25519.pub"This identifies the public key you intend to enrol. Never upload the file without .pub as a substitute.
2. Confirm the image’s default account and enrolment method
Use the key field or supported management workflow actually provided for the selected service. Different images use different default usernames, and some platforms apply key changes only during initial provisioning. Do not assume a provider profile edit updates every existing guest.
3. Verify guest enrolment and first login
After provisioning completes, connect with the expected account and explicit key. The sample username must be replaced by the account assigned for the image.
ssh -o IdentitiesOnly=yes -i "$env:USERPROFILE\.ssh\server_ed25519" adminuser@203.0.113.10Verify the server fingerprint independently before accepting it. A successful login confirms that the chosen public identity was authorised for that account.
Check the result
- The enrolled fingerprint is the intended public key.
- The image’s actual account accepts a fresh key-based SSH login.
Troubleshooting
- The key is correct but login is rejected
- Check the image username and initialisation status before regenerating keys.
- Changing a provider key list had no effect
- Confirm whether that control affects new instances only or supports updating existing guests.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.