SSH agent holds your private keys in memory, decrypted, so you don't need to type your passphrase every time. Once a key is added to the agent, any SSH command can use it without prompting.

Start the agent:

$ eval "$(ssh-agent -s)"

This sets $SSH_AUTH_SOCK and $SSH_AGENT_PID. Most login shells start it automatically.

Add a key to the agent:

$ ssh-add ~/.ssh/id_ed25519

Prompts for the key's passphrase, then stores the decrypted key in memory.

Auto-add keys on first use (configure in ~/.ssh/config):

Host *
    AddKeysToAgent yes

List keys in the agent:

$ ssh-add -l

Shows fingerprints and comments of loaded keys.

Remove a key:

$ ssh-add -d ~/.ssh/id_ed25519

Remove all keys:

$ ssh-add -D

Set key timeout (auto-remove after N seconds):

$ ssh-add -t 3600 ~/.ssh/id_ed25519

Troubleshooting:

• If ssh -l shows keys but SSH still prompts for password, check that $SSH_AUTH_SOCK is set and readable
• On macOS, ssh-add -K stores the passphrase in Keychain
• If agent dies, restart: eval "$(ssh-agent -s)" and re-add keys

Forwarding the agent to a remote host:

$ ssh -A user@host

Allows the remote host to use your keys (careful with untrusted hosts). Configure in ~/.ssh/config with ForwardAgent yes.