SSH Keys on Netrouting: Store Once, Use on Every Server and VM — Portal and API

Method 1 — In the portal

Store a key

1. Log in at amoni.app and open SSH Keys in the left-hand menu.
2. Under Add a key, give it a name you will recognise later (work laptop, ci-runner) and paste the contents of the .pub file.
3. Click Add key. The key appears in the list with its fingerprint. A pasted line that is not an OpenSSH public key is refused with a message saying what a valid one starts with; a key you already stored is refused by name.

Deleting a key here (the bin icon) removes it from the list only. Machines that already have it keep it until their next reinstall or rebuild; remove it from a running machine by editing ~/.ssh/authorized_keys there, or with the live update below.

Use keys on a fresh system

• Bare metal: on the server's Reinstall tab, tick the stored keys under SSH Keys, or paste extra ones. See reinstall the operating system.
• Cloud: in the Rebuild VM dialog, tick keys under SSH keys for the new system. See rebuild.

The server's own SSH Keys tab is a read-only view of the same list, there so you can check what will be offered at reinstall.

Apply keys to a running cloud instance

1. Open the instance and its SSH Keys tab.
2. Tick the keys that should be on the machine. The button counts them: Apply to VM (1).
3. Click Apply to VM. The selected set is written to the machine's provisioning drive; it replaces what was applied that way before.
4. Do a Stop and then a Start from the instance header. That regenerates the provisioning drive; a plain reboot does not, so the keys would not land.

Use in rebuild on the same tab jumps to the rebuild dialog with the keys pre-selected, for when a fresh system is what you want anyway.

Method 2 — With the API

The key store needs the SSH Keys scope (sshkeys.write) to change and read to list; applying to an instance needs vms.write. Reference: api.amoni.app/v1/docs.

Store a key

curl -s -X POST https://api.amoni.app/v1/ssh-keys \
  -H "Authorization: Bearer nr_live_..." \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"ci-runner\", \"public_key\": \"$(cat ~/.ssh/id_ed25519.pub)\"}"

{ "success": true, "data": { "id": 42, "fingerprint": "SHA256:Zt3v9Qk2mXpL7r4w...", "key_type": "ssh-ed25519" } }

List and delete

curl -s https://api.amoni.app/v1/ssh-keys -H "Authorization: Bearer nr_live_..."

{ "success": true, "data": [ { "id": 42, "name": "ci-runner", "public_key": "ssh-ed25519 AAAA...", "key": "ssh-ed25519 AAAA...",
    "fingerprint": "SHA256:...", "key_type": "ssh-ed25519", "created_at": "2026-09-15 10:12:00" } ] }

key repeats public_key; both are kept for older clients.

curl -s -X DELETE https://api.amoni.app/v1/ssh-keys/42 -H "Authorization: Bearer nr_live_..."

Use the ids everywhere else

Pass stored key ids as ssh_key_ids to POST /v1/servers/{id}/reinstall and POST /v1/vms/{accountId}/{vpsId}/rebuild; pass raw keys, one per line, as sshkeys. Both fields may be combined.

Apply to a running instance

curl -s -X PUT https://api.amoni.app/v1/vms/990204/411/ssh-keys \
  -H "Authorization: Bearer nr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ssh_key_ids": [42]}'

{
  "success": true,
  "data": {
    "username": "root",
    "applied": [ { "name": "ci-runner", "fingerprint": "SHA256:..." } ],
    "pasted_key_count": 0,
    "message": "Keys saved to the machine's provisioning drive. ..."
  }
}

Then stop and start the instance (POST .../power with stop, then start) so the drive is regenerated. Container-type instances have no provisioning drive; the call answers 422 for them and keys land only at creation.

What the API will tell you