Project Secrets for GitHub SSH

Where to start

Open Settings -> Environment -> Secrets, then choose Generate SSH Deploy Key.

CoCalc creates a fresh Ed25519 keypair for the project and shows the public key. Add that public key to the GitHub repository as a deploy key.

What CoCalc sets up

• Stores the private key as the encrypted project secret SSH_PRIVATE_KEY.
• Mounts project secrets read-only at /run/secrets/cocalc/<name>.
• Sets COCALC_SECRETS so scripts can find the mounted secrets directory without hardcoding the path.
• Writes the public key to .ssh/id_ed25519.pub.
• Creates .ssh/id_ed25519 as a symlink to the mounted private-key secret and restarts the project so SSH can use it.

Use it with GitHub

ssh -T git@github.com
git clone git@github.com:owner/repository.git
cd repository
git remote -v

After GitHub has the deploy key, normal SSH-based Git operations use the project key automatically. Codex can then clone, fetch, and push through the same terminal workflow you can inspect.

This is separate from gh authentication. If you also want Codex to create issues, open pull requests, or edit releases with gh, authenticate gh with a suitably scoped GitHub account or token.

Security model

Project secrets are encrypted at rest and hidden from the file explorer, downloads, backups, rootfs images, and public sharing. They are meant for credentials, not for ordinary configuration.

The important caveat is runtime access: any code or collaborator with access to the running project can read mounted secret files. Use a deploy key or token with the narrowest permissions that fit the job.