Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Laravel Forge’s Permission denied (publickey) message means an SSH server rejected a key-based login. It does not tell you which connection failed. Forge deployments normally involve two separate SSH trust relationships: your computer connecting to the Forge server, and the Forge server connecting to your Git repository host. Test those hops independently, then repair the key registration at the point that rejects it.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The fastest reliable method is to identify the failing hop, run SSH in verbose mode, verify the host and username, confirm the intended private key is available to the correct user or agent, and register the matching public key in the right place.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the error actually tells you
GitHub’s documentation defines a “Permission denied” error as the server rejecting your connection. In a Forge workflow, that statement is incomplete until you identify the server involved. A failed login from your workstation to a Forge server is unrelated to a failed Git operation from the Forge server to GitHub, GitLab, or Bitbucket, even if both failures display the same text.
There are two independent authorization records:
- Server access: the Forge server must recognize your workstation’s public key for the server account you use.
- Repository access: the source-control provider must recognize the Forge server’s SSH public key, usually as an account key or repository deploy key with the required read permission.
A key can be valid for one relationship and completely unknown to the other. Adding your laptop key to a repository will not grant your laptop access to the server, and adding your laptop key to the server will not authorize Forge to clone a private repository.
#1 Best Overall
Step 1: Identify which SSH hop is failing
Start with the operation that produced the error and classify where it happened. If you cannot open an SSH session to the machine managed by Forge, the failing hop is workstation-to-server. If you can log in but a deployment stops while cloning or fetching code, the failing hop is server-to-provider.
Test direct access to the Forge server
From your workstation, connect using the same server hostname, account name, and private-key selection used for administration:
ssh -v user@serverReplace user and server with the actual Forge account and hostname. A successful test reaches a shell or at least completes authentication. A public-key rejection here means the server-side account does not accept the public half of the key being offered, or your client is offering a different key than you expect.
Test repository access from the deployment environment
Repository authentication must be tested from the environment that performs the deployment—the Forge server or its deployment user—not from your laptop. For GitHub, the basic diagnostic is:
ssh -vT [email protected]For another provider, substitute that provider’s SSH hostname while retaining the provider-required SSH account, normally git. This test does not clone a repository; it verifies whether the provider accepts the key presented by the deployment environment. If this command fails on the server while your laptop can access the repository, the problem is the Forge deploy key or the server’s SSH configuration, not your personal workstation key.
Step 2: Read verbose SSH output instead of guessing
The -v option shows key discovery and authentication decisions. Run it on the exact hop that failed:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchssh -vT [email protected]ssh -v user@serverLook for the identity-file lines first. GitHub explains that an identity file displayed with a missing marker means the file was not found. That is a local path problem: the client cannot offer a key that is absent or named differently. An Offering public key line proves that a particular key was actually presented to the server. It does not prove that the server authorized it; the provider or server may still reject that key.
Use the verbose trace to answer three concrete questions:
- Which host did the client contact?
- Which SSH username did it use?
- Which identity files or agent keys did it offer?
Do not infer the answer from the key filename alone. A key named for one project may have been replaced, and an SSH agent can offer a different key before the file you intended.
Step 3: Verify the host and SSH username
SSH authorization is tied to both the destination and the account name. Repository URLs must use the source-control provider’s expected SSH host and user. For GitHub repository access, that user is git, not your personal GitHub username. GitHub documents that using a personal username in the SSH URL causes Permission denied (publickey).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
Check the repository’s configured remote from the deployment environment:
git remote -vConfirm that the remote is an SSH URL for the intended provider and that its user portion is git where the provider requires it. Correcting the hostname or username can resolve an error without changing any keys. It also prevents you from registering a valid key on one provider while the deployment is contacting another host.
For direct Forge access, verify that the hostname resolves to the intended server and that the account in the command is the account whose authorized_keys entry Forge manages. A key installed for one server user will not authenticate a different user.
Step 4: Confirm the private key and SSH agent
The client must have access to a private key, and the corresponding public key must be the one registered at the rejecting server. List fingerprints currently loaded in the SSH agent with:
Recommended Free Tools
ssh-add -l -E sha256If the command reports no identities, load the intended private key into the agent or create a replacement pair, then register the new public half at the appropriate destination. If an identity is listed, compare its SHA-256 fingerprint with the public key you believe Forge or the repository provider should use.
Keep the execution user consistent. Running one diagnostic with sudo and another as your normal account can select a different home directory, SSH configuration, agent socket, and key set. GitHub warns that elevated commands may therefore appear to “lose” a key that works in an ordinary shell. Repeat the test as the same user that owns the deployment or administrative session, and avoid sudo unless the command specifically requires it.
When the intended key is not being offered
If verbose output shows a missing identity file or never shows Offering public key for the expected fingerprint, fix local key selection before changing server permissions. Load the correct key into the agent, point your SSH configuration at the correct private-key file, or create and register a replacement pair. Then rerun the same verbose command and confirm that the intended identity is offered.
When the key is offered but rejected
An offered key that is rejected has reached the correct server but is not authorized there, is authorized for a different account, or is being evaluated on the wrong host. Proceed to the authorization section for the failing hop; generating more keys without removing the mismatch usually makes diagnosis harder.
Free tools Windows power users keep installed
One-click scans. No signup required.
Repair workstation-to-Forge server access
Laravel’s SSH guidance says to add your machine’s public key to the server so the SSH service can identify connections from your computer and grant access. In Forge, open the server’s SSH Keys list and add the public key that matches the private key used by your workstation account.
Use the matching public half
Never paste a private key into Forge. The public key is the single-line value that can be shared; it commonly ends with a comment identifying the machine or user. Its fingerprint must match the private key loaded in the account’s agent. If you have multiple computers or agents, label them clearly so you do not authorize an obsolete key.
Check the account and scope
Add the key for the server account you actually use in ssh -v user@server. If the key was added for another Forge user, the SSH daemon will continue to reject it for your account. After saving the key, rerun the direct SSH test from the same workstation and without sudo.
Repair Forge-to-repository access
Forge uses a server-side SSH key when it fetches or deploys code. Forge’s deploy-key guidance states that this server key is added to connected GitHub, GitLab, or Bitbucket accounts and can be managed as a repository deploy key.
Find the key Forge is using
Inspect the Forge server’s SSH-key settings and identify the public key associated with the connected source-control account or repository. Compare its fingerprint with the key offered by the deployment user in:
ssh -vT [email protected]Run the command on the Forge server, because the server—not your workstation—performs the Git authentication. If the offered fingerprint is different from the key registered with the provider, update the provider registration or correct the server’s key selection.
Authorize the intended repository
Confirm that the key is attached to the repository being deployed and has read access. A deploy key for Repository A does not automatically authorize Repository B. Likewise, an account key may have different repository permissions from a repository-specific deploy key. Check the repository remote, provider organization, and access scope before replacing keys.
After the provider accepts the key, rerun the SSH test from the server and then retry the deployment. Testing first separates authentication from later deployment problems such as an incorrect branch or build command.
Reconnect a revoked Forge server
A revoked server has a separate operational state from an ordinary key mismatch. Forge’s API documents a reconnect call that returns a public key. The recovery sequence is:
- Call the documented reconnect operation for the revoked server.
- Capture the public key returned by that operation.
- Add that public key to the server so its SSH service can identify Forge’s connection.
- Reactivate the server in Forge.
- Test server access and repository access independently before starting a deployment.
Do not treat a revoked server as proof that your laptop key is wrong. The reconnect flow supplies a new server authorization value; install that returned key exactly, then complete reactivation.
Quick Recap
Choose the fix by failing hop
| Observed failure | First test | Key location to inspect | Authorization scope |
|---|---|---|---|
| Cannot open a Forge server shell | ssh -v user@server from your workstation |
Workstation file or agent, then the server’s Forge SSH Keys list | Your server user |
| Server shell works, deployment cannot clone | ssh -vT [email protected] (or the provider host) on the Forge server |
Forge server SSH key and provider registration | Connected account or target repository |
| Verbose output shows a missing identity file | Review the path printed by SSH | Private-key file and agent for the executing user | Local key availability |
Verbose output shows Offering public key followed by rejection |
Compare the offered fingerprint with the registered key | Server or provider authorization record | Specific user or repository |
| Forge marks the server revoked | Use the documented reconnect operation | Returned public key and server authorization | Server reactivation state |
Common mistakes that prolong the outage
- Testing from the wrong machine: a repository test from your laptop says nothing about the key Forge uses during deployment.
- Using a personal repository username: provider SSH endpoints generally expect
git; GitHub specifically rejects the personal-username form for this authentication path. - Registering the wrong half of a key pair: the provider or Forge receives the public key, while the client retains the private key.
- Mixing users with
sudo: root and your normal account can have different agents and SSH directories. - Adding a key to the wrong scope: a server login key, account key, and repository deploy key solve different authorization problems.
- Creating keys before reading the trace: first determine whether the existing key is absent, offered, or rejected.
A repeatable recovery checklist
- Record whether the failure occurs before server login or during repository access.
- Run the matching verbose SSH command on the correct machine.
- Confirm the destination hostname and SSH username, using
gitfor GitHub repository access. - Check the identity-file messages and the
Offering public keyline. - Run
ssh-add -l -E sha256as the same user that performs the operation. - For server access, add the workstation’s matching public key in Forge’s server SSH Keys list.
- For repository access, register Forge’s server key with the intended provider account or repository deploy-key record.
- If the server is revoked, reconnect it, install the returned public key, and reactivate it.
- Retest the individual SSH hop before retrying the full deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
