Generated Instance SSH Credentials
Morph generates an SSH credential bundle for each instance. The bundle contains a private key, its public key, and a password. It is intended for trusted automation and carefully controlled, instance-specific access.
Choose the right credential
Generated instance credentials and managed SSH public keys are independent:
| Managed SSH public key | Generated instance credentials | |
|---|---|---|
| Owner and scope | One user; direct SSH to that user's instances and current organizations | One instance |
| Material stored in account settings | Public key only | None |
| Material returned to the caller | Public metadata | Private key, public key, and password |
| Rotation or revocation | Revoke one named user key | Rotate the instance credential bundle |
Rotating an instance's credentials invalidates older copies of that instance bundle. It does not revoke any user's managed SSH public keys. Likewise, revoking a managed public key does not rotate or invalidate an instance bundle.
Retrieve an instance credential bundle
Treat retrieval as a secret-handling operation. Prefer using the credentials in memory. If you must write them to disk, create the destination with owner-only permissions.
- Python
- CLI
import os
from pathlib import Path
from morphcloud.api import MorphCloudClient
client = MorphCloudClient(api_key=os.environ["MORPH_API_KEY"])
instance = client.instances.get(instance_id="morphvm_abc123")
credentials = instance.ssh_key()
bundle_path = Path("./morphvm_abc123-ssh.json")
fd = os.open(bundle_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
os.fchmod(fd, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as bundle_file:
bundle_file.write(credentials.model_dump_json(indent=2) + "\n")
umask 077
morphcloud instance ssh-key morphvm_abc123 \
> ./morphvm_abc123-ssh.json
Do not commit the resulting file. Delete it securely when it is no longer needed.
Rotate instance credentials
Rotation generates a new private/public key pair and password for the instance. Existing copies of the old bundle must be treated as invalid and removed from every recipient and secret store.
import os
from morphcloud.api import MorphCloudClient
client = MorphCloudClient(api_key=os.environ["MORPH_API_KEY"])
instance = client.instances.get(instance_id="morphvm_abc123")
new_credentials = instance.ssh_key_rotate()
# Consume or store new_credentials through your approved secret-management path.
Rotate immediately when a bundle is exposed or a recipient's access should end. Rotation may interrupt automation or sessions that rely on the old generated private key, so coordinate dependent systems before routine rotation.
Delegate instance-specific access
If a recipient needs SSH access to exactly one instance without a Morph API key, follow Share SSH access (no API key). That guide shows how a trusted operator can mint and hand off an instance access bundle without exposing the API key.
Do not add the generated public key to the recipient's account settings as a substitute for a bundle. Account-managed public keys are user-owned and receive the user's full current organization-derived SSH scope.