What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To deploy a private repository, create an ED25519 key pair in Coolify, add its public key to that repository’s Deploy keys or Access keys, and give Coolify the repository’s SSH clone URL. The private key remains stored in Coolify; the Git provider uses the public half to authorize cloning. Repository access does not enable automatic deployments by itself, so configure a webhook or app-based event trigger separately.
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
What a Coolify deploy key does
A deploy key is an SSH key pair assigned to a repository. Coolify stores and uses the private half when it clones or fetches source code. The Git provider stores the public half and grants that key access to the repository where it was registered.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Coolify’s documentation describes a deploy key as one SSH key granting access to one private repository. That narrow scope is useful when an application should read one codebase without granting an account-wide credential. Keep the key read-only unless a workflow explicitly requires the provider’s write permission; a normal Coolify deployment only needs to clone and fetch.
The key authenticates source access, not deployment events. A successful clone proves that the server can read the repository, but it does not tell Coolify that a push occurred. Push-triggered deployments require a webhook, a provider app integration, or a CI job that calls Coolify’s deploy endpoint.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Think of the two halves as serving different purposes. The private key is the credential Coolify presents to the Git host. The public key is the registration that tells the host which repository may accept that credential. A matching pair attached to the wrong repository, or a correct pair combined with an HTTPS URL, still results in an authentication failure.
Before you start
- Have administrator or owner access to the Coolify instance and permission to create private keys.
- Have permission to manage deploy keys in the target repository.
- Know the exact repository and branch that the application should deploy.
- Ensure the deployment server can resolve the Git host and make outbound connections to it.
- Plan to use an unattended SSH key. Coolify deployments cannot stop for a passphrase prompt or an interactive second-factor challenge.
Use one key per repository. A repository-specific key limits the impact of accidental exposure and makes later rotation predictable. If the Git provider does not accept ED25519, use RSA instead; otherwise ED25519 is the preferred choice in Coolify’s key-generation screen.
Record the repository, branch, Coolify application, server, and key name as you work. These details make it easier to identify a mismatched credential later, especially when an instance contains several applications or when a team rotates keys on different schedules.
Step 1: Generate the key in Coolify
- In the Coolify dashboard, open Keys & Tokens > Private Keys.
- Select New private key.
- Choose Generate ED25519. Choose RSA only for a provider or legacy system that rejects ED25519.
- Let Coolify save the key. It is stored immediately as a private-key record.
- Edit the record and give it a repository-specific name, such as
billing-api-production. A descriptive name matters when several applications use different keys. - Save the record, then copy the complete value shown as Public key.
Do not add a passphrase. Coolify needs to use this key without a person present to unlock it. Do not copy the private key into the repository, a deployment image, or a managed server account. The public key is the only part that belongs in the Git provider.
A name or comment helps people recognize a credential, but it is not a security control. Renaming a key or changing its comment does not change the cryptographic pair. If a key is exposed, replace it rather than trying to make the existing record look different.
Step 2: Add the public key to the repository
Open the settings for the exact private repository that Coolify will clone. Paste the entire public-key value, including its ssh-ed25519 prefix and trailing comment if Coolify displays one. Do not wrap it in quotation marks or split it across lines.
Repository-level registration is important. An account-level SSH key can grant broader access than this deployment needs, while a deploy key is intentionally limited to the project where it is installed. Confirm the organization, group, owner, and repository names before saving the key.
GitHub repositories
Open the repository’s settings and its Deploy keys section. Add a new key, provide a recognizable title, and paste the public key. Leave Allow write access disabled. A read-only deploy key is sufficient for checkout and prevents the deployment credential from pushing code or changing repository content.
After saving, verify that the key appears in the repository’s deploy-key list and is enabled. If the provider shows a fingerprint or key title, compare it with the name you assigned in Coolify so that a similarly named key is not selected by mistake.
GitLab projects
Open the project and go to Settings > Repository > Deploy keys. Add the copied public key, name it for the Coolify application, and keep write permission disabled. GitLab may let a project administrator enable or disable an existing key; verify that the key is enabled for this project.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not assume that a key enabled for one GitLab project is automatically enabled for another project in the same group. Deploy-key authorization remains tied to the project where the key was registered.
Other Git-compatible providers
Look for a repository-level setting called Deploy keys, Access keys, or an equivalent SSH-key permission page. The important properties are repository scope, a complete public key, and read-only access. Account-level SSH keys are a different mechanism and can grant broader access than this workflow intends.
If the provider offers separate read and write controls, select read-only. If it offers no deploy-key feature, use the provider’s documented app or token integration instead of placing an account credential in an unprotected location. Coolify’s deploy-key flow assumes that the provider accepts an SSH public key for repository access.
Step 3: Use the repository’s SSH clone URL
Copy the SSH clone address from the provider’s repository page. In Coolify’s deploy-key flow, use SSH rather than HTTPS:
[email protected]:owner/repo.git[email protected]:group/project.git
Replace the owner, group, and repository names with the real values. Do not paste an HTTPS address such as https://...; an SSH private key cannot authenticate an HTTPS clone in the way Coolify expects.
The URL must point to the same repository where the public key was registered. A key attached to one project will not authorize a similarly named project in another organization or group. The deployment server also needs DNS and outbound network access to the Git host, including any required firewall or egress rules.
Copy the URL exactly as supplied by the provider. Small changes to the host, group path, repository name, or suffix can point to another project or prevent the Git client from locating the repository. For self-hosted or less common providers, confirm that the hostname resolves from the Coolify destination server, not just from your workstation.
Step 4: Create the Coolify application
- Open the appropriate Coolify project.
- Select + New, then choose Private Repository (with deploy key).
- Select the destination server.
- Choose the repository-specific private key you created under Keys & Tokens > Private Keys.
- Paste the repository’s SSH clone URL.
- Select the branch to deploy.
- Configure the build, runtime, domain, environment variables, health checks, and other application settings required by the project.
- Select Deploy.
Watch the deployment log rather than relying only on the final status. A successful authentication should be followed by a clone or fetch and a checkout of the requested branch or commit. The log gives you the first useful split in troubleshooting: an SSH or repository error points to credentials, URL, permissions, or network reachability; a later build or runtime error is an application configuration problem.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Check the selected branch deliberately. A key can authenticate successfully while the application still deploys an unintended branch. Likewise, a successful checkout does not validate environment variables, build commands, health checks, or runtime configuration; those are separate stages of the deployment.
Deploy keys versus other repository connection methods
Choose the connection method according to the number of repositories, required events, and provider capabilities.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | Best fit | Repository access | Event and setup behavior |
|---|---|---|---|
| Deploy key | One private repository, or an organization where an app cannot be installed | One repository-scoped SSH credential; normally read-only | Webhooks or another trigger must be configured separately |
| GitHub or GitLab App | Several selected repositories, repository browsing, push events, or pull-request previews | Provider-managed selection of allowed repositories | App integration can provide repository selection and event or webhook configuration more directly |
| Public HTTPS repository | Public source that needs no credentials | No deploy key required | Use the provider’s public-repository workflow; private-key setup is unnecessary |
Coolify’s GitHub guidance positions deploy keys for a single private repository or for organizations where an app cannot be installed. Its GitLab guidance gives the same one-repository and unavailable-OAuth rationale, while describing app-based browsing and events. The GitLab App integration is documented as available in Coolify version 4.3.0 and later. Provider app behavior and dashboard labels can change with subsequent Coolify releases, so verify the current provider-specific guide when standardizing a production setup.
An app is usually a better fit when one integration must browse or manage several selected repositories, receive push events, or support pull-request previews. A deploy key is simpler when only one repository needs read access or when organizational policy prevents installing an app. A public repository needs neither credential, although its source is visible by design.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Enable automatic deployment after a push
The SSH key only grants repository access. To deploy when code is pushed, connect a provider event to Coolify.
Using a provider webhook
- In Coolify, open the application’s webhook or deployment-trigger settings and copy the generated webhook URL and secret.
- In the repository provider, create a webhook that points to that URL.
- Authenticate the webhook with the secret supplied by Coolify.
- Select push events, or the equivalent event type that should start a deployment. Avoid enabling unrelated events unless the application needs them.
- Back in Coolify, open Advanced > Deployment > Auto deploy and select Deploy on push (webhooks).
- Push a controlled commit to the configured branch and check the resulting deployment log.
If the provider app integration is available and suitable, it can handle repository selection and event configuration more closely than a manually maintained webhook. For a Git provider that Coolify does not integrate directly, run a CI job after the required checks pass and have that job call Coolify’s deploy webhook.
Keep the webhook secret private. A deploy key and a webhook secret protect different paths: the key authorizes source retrieval, while the secret authorizes an event request to start a deployment.
Test the event path independently from the clone path. A manual deployment can succeed while the webhook is pointed at an old URL, configured for the wrong event, or rejected because its secret does not match. Send a controlled push only after confirming that the Coolify application is set to deploy the intended branch.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security and key rotation
Protect the private half
- Keep the private key inside Coolify’s private-key store.
- Never commit it to source control, place it in an image, or copy it to a managed server’s home directory.
- Use a separate key for each repository instead of sharing one credential across applications.
- Leave provider write access disabled unless a documented automation task truly needs to write.
- Restrict dashboard access so only administrators who need deployment control can view or modify keys.
A provider deploy key is not a server-login key. Adding it to GitHub, GitLab, or another Git provider authorizes repository operations; it does not add the key to a server account’s ~/.ssh/authorized_keys and does not authorize shell access.
Keep the key and webhook secret separate in your operational records. They have different revocation paths: removing a public deploy key blocks repository access, while changing or disabling the webhook secret blocks event requests. Rotating one does not rotate the other.
Rotate a key without breaking deployment
- In Coolify, generate a replacement key, preferably ED25519, and name it for the same repository plus its rotation date or generation.
- Copy the replacement public key.
- Add that public key to the repository while the old key is still enabled.
- Edit the Coolify application to select the replacement private key.
- Deploy and confirm a successful clone and checkout in the deployment log.
- Remove the old public key from the provider and delete or disable the old private-key record in Coolify.
Adding the replacement before removing the old one creates a safe overlap period. If a shared key is being retired, migrate every dependent application first and verify each deployment before deleting the old credential.
Keep a record of which application uses each key. During rotation, that inventory tells you whether an apparently unused key is genuinely obsolete or still selected by another resource. Do not remove the old provider key until every dependent application has completed a test deployment with the replacement.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If a key may be exposed
Treat exposure as a credential compromise. Remove the corresponding public key from the provider, remove the private key from Coolify, generate a new key, register its public half, update the application, and redeploy. Do not rely on merely renaming the key or changing its comment; those actions do not change the cryptographic credential.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting by symptom
Clone authentication fails
- Confirm that the public key is attached to the exact repository, not only to the organization or a different project.
- Check that the private-key record selected in Coolify is the pair that produced that public key.
- Verify that the repository address begins with the provider’s SSH form, such as
[email protected]:or[email protected]:, rather than HTTPS. - Make sure the key was pasted completely and remains enabled at the provider.
- Confirm that the deployment server can resolve the Git host and reach it over the network.
If the failure occurs before any build output, focus on the key pair, repository registration, URL, and network path. Recreating application settings will not fix an SSH authorization error. Compare the public key displayed in Coolify with the one registered at the provider and verify that no line breaks or omitted characters were introduced when copying it.
The key works for one repository but not another
That is expected for a repository-scoped deploy key. Register a separate public key on the second repository and create or select its matching Coolify private-key record. Do not assume that access to one project carries over to another project in the same organization or group.
The repository clones, but a push does not deploy
Authentication is working; the event path is not. Check that the provider webhook exists, uses the current Coolify URL and secret, listens for push events, and can reach the Coolify instance. Then verify Advanced > Deployment > Auto deploy > Deploy on push (webhooks). If you use an app integration, inspect its repository selection and event permissions. For CI-triggered deployments, review the job log and the request sent to Coolify.
Also check branch alignment. A webhook may fire correctly while the Coolify application watches a different branch from the one receiving the commit. Confirm the provider event, Coolify branch setting, and deployment log all refer to the same branch.
The deployment reaches the server but fails later
Separate source retrieval from application execution. A successful checkout means the deploy key did its job. Review the subsequent build output, environment variables, Docker or build-pack configuration, health checks, and runtime logs for the actual failure.
Another Git provider cannot be reached
When the key and URL are correct but the provider is unreachable, test DNS resolution and outbound network connectivity from the deployment server to the Git host. Check firewall, proxy, and egress restrictions before changing credentials.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11This distinction matters for self-hosted or less common Git services. A valid public key cannot help if the destination server cannot resolve the provider hostname or establish the required outbound connection.
Production checklist
- ED25519 key generated in Keys & Tokens > Private Keys, with no passphrase.
- Repository-specific name assigned to the Coolify key.
- Complete public key added to the exact repository’s Deploy keys or Access keys page.
- Write access left disabled.
- SSH clone URL used in Private Repository (with deploy key).
- Correct server, branch, and application settings selected.
- Deployment log confirms clone and checkout of the intended branch or commit.
- Webhook, app event integration, or CI trigger configured separately for push deployments.
- Private key kept only in Coolify and a rotation plan documented.
For a production handoff, include the key name, repository, branch, destination server, trigger type, and last successful deployment in your runbook. Do not include the private key itself. This gives the next administrator enough information to operate and rotate the integration without exposing the credential.
Frequently Asked Questions
Can I use an HTTPS repository URL with a Coolify deploy key?
No. In the deploy-key flow, use the provider’s SSH clone URL, such as [email protected]:owner/repo.git or [email protected]:group/project.git. The public key must be registered on that same repository.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Where do I add Coolify’s public key on GitHub?
Open the repository settings, go to Deploy keys, add a key, paste the complete public key, and leave Allow write access disabled.
Recommended Free Tools
Where do I add it on GitLab?
In the project, open Settings > Repository > Deploy keys. Add the public key, name it for the application, and ensure the key is enabled with write permission disabled.
Does a deploy key trigger deployments when I push?
No. The SSH key only authorizes cloning and fetching. Configure a provider webhook, a GitHub or GitLab App event integration, or a CI job that calls Coolify’s deploy webhook.
Should the deploy key have write access?
Normally no. Coolify needs to read the repository for checkout, so keep GitHub or GitLab write access disabled unless a documented automation task must push changes.
Why does the key work for one repository but not another?
Deploy keys are repository-scoped. Add a separate public key to the second repository and select the matching private-key record in its Coolify application.
Can I protect the Coolify key with a passphrase?
No for this unattended workflow. Coolify must be able to use the private key without an interactive passphrase or second-factor prompt.
What is the safest way to rotate a deploy key?
Generate a replacement, add its public key while the old key remains enabled, switch the Coolify application, complete a successful deployment, then remove the old provider key and Coolify record. Migrate every dependent application before deleting a shared key.
Does adding the deploy key to GitHub authorize my server account?
No. A provider deploy key authorizes repository operations only. It does not add the key to a server user’s ~/.ssh/authorized_keys or grant shell access.
The Bottom Line
Create a passphrase-free ED25519 key under Keys & Tokens > Private Keys, register its public half on the exact repository with read-only permissions, and use that repository’s SSH clone URL in Private Repository (with deploy key). Confirm the clone and checkout in the deployment log, then configure a webhook or app event separately if pushes should deploy automatically. Keep one key per repository and rotate by adding the replacement before removing the old credential.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
