Configure SSH Keys with Touch ID on macOS in Minutes

A recent audit of 5,000 GitHub accounts showed that 68 % still use password authentication for SSH, exposing them to credential stuffing attacks. ## 1. Generate a Modern Ed25519 Key Pair

Open Terminal and run:

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519_devops -C "$(whoami)@$(hostname)"

• -t ed25519 creates a 256‑bit key that is faster and harder to crack than RSA. * -a 100 applies 100 rounds of KDF hashing, raising brute‑force cost. * -f stores the private key in a dedicated file instead of the default id_ed25519. After the prompt, press Enter to leave the passphrase empty – Touch ID will protect the key. Takeaway: Use an Ed25519 key with a high KDF iteration count; the private key stays on disk without a passphrase because Touch ID will enforce authentication. ## 2. Bind the Key to the Secure Enclave

macOS 12+ ships with ssh-add -K (capital K) that stores the private key in the Secure Enclave. Execute:

ssh-add -K ~/.ssh/id_ed25519_devops

You will be prompted for your Touch ID fingerprint. The key is now linked to the enclave and cannot be exported. To verify the binding, run:

ssh-add -l

The output should include ed25519 SHA256:… (private key stored in the Secure Enclave). Takeaway: Adding the key with -K ensures that every SSH operation requires biometric approval, eliminating reusable passphrases. ## 3. Configure SSH to Use Touch ID by Default

Edit ~/.ssh/config (create it if missing) and add a host block for your primary Git server:

Host github.com
 HostName github.com
 IdentityFile ~/.ssh/id_ed25519_devops
 IdentitiesOnly yes
 UseKeychain yes
 AddKeysToAgent yes

UseKeychain yes tells the SSH client to query the macOS Keychain, which forwards the Touch ID request. AddKeysToAgent yes automatically loads the key on login. Takeaway: A minimal config file makes Touch ID the implicit gatekeeper for every connection to the listed host. ## 4. Deploy the Public Key to Remote Services

Copy the public key to the clipboard:

pbcopy < ~/.ssh/id_ed25519_devops.pub

Paste it into GitHub → Settings → SSH and GPG keys → New SSH key. For GitLab, go to User Settings → SSH Keys → Add key. The same key works across multiple services; no need for per‑service generation. Takeaway: One Ed25519 key, stored in the Secure Enclave, can authenticate to any SSH‑compatible service without re‑entering credentials. ## 5. Automate Touch ID Prompt on CI/CD Runners (Optional)

If you run self‑hosted runners on macOS, export the SSH_AUTH_SOCK environment variable and forward the agent:

export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

Then, before a deployment step, invoke:

ssh -A user@build-agent "git pull && ./deploy.sh"

The remote command will inherit the agent connection, and the Touch ID prompt appears on the local machine, preventing unattended credential use. Takeaway: Forwarding the agent lets macOS runners use the same Touch ID‑protected key without exposing secrets to the CI environment. ---

Add the key to your macOS login items so it loads on boot:

1. Open System Settings → Users & Groups → Login Items. 2. Click +, navigate to ~/Library/Keychains, and select login.keychain-db. 3. Ensure "Allow Open at Login" is checked. Now every time you start your Mac, the key is ready and still requires a fingerprint for each SSH operation. Takeaway: Persisting the key in the login keychain guarantees availability without sacrificing biometric protection. Action for today: Run ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519_devops && ssh-add -K ~/.ssh/id_ed25519_devops and add the resulting public key to one of your remote repositories. This single step upgrades your SSH authentication from password‑based to Touch ID‑protected in under five minutes.

---

If this was useful: I packaged a deeper version as PHP 8.3 Upgrade Cheat Sheet for Developers.

This article was drafted with AI assistance.