# SSH Agent

**SSH agent** holds your private keys in memory, decrypted, so you don't need to type your passphrase every time. Once a key is added to the agent, any SSH command can use it without prompting.

Start the agent:

```bash
$ eval "$(ssh-agent -s)"
```

This sets `$SSH_AUTH_SOCK` and `$SSH_AGENT_PID`. Most login shells start it automatically.

Add a key to the agent:

```bash
$ ssh-add ~/.ssh/id_ed25519
```

Prompts for the key's passphrase, then stores the decrypted key in memory.

Auto-add keys on first use (configure in `~/.ssh/config`):

```
Host *
    AddKeysToAgent yes
```

List keys in the agent:

```bash
$ ssh-add -l
```

Shows fingerprints and comments of loaded keys.

Remove a key:

```bash
$ ssh-add -d ~/.ssh/id_ed25519
```

Remove all keys:

```bash
$ ssh-add -D
```

Set key timeout (auto-remove after N seconds):

```bash
$ ssh-add -t 3600 ~/.ssh/id_ed25519
```

Troubleshooting:

- If `ssh -l` shows keys but SSH still prompts for password, check that `$SSH_AUTH_SOCK` is set and readable
- On macOS, `ssh-add -K` stores the passphrase in Keychain
- If agent dies, restart: `eval "$(ssh-agent -s)"` and re-add keys

Forwarding the agent to a remote host:

```bash
$ ssh -A user@host
```

Allows the remote host to use your keys (careful with untrusted hosts). Configure in `~/.ssh/config` with `ForwardAgent yes`.