# Key pairs

A key pair is the SSH key you log in to instances with. Learn how the platform uses it at launch and what happens when you delete one.

A key pair is an SSH key registered in a project. Every launch names one, and the platform installs its public half for the instance’s login user. You log in with the matching private key. There is no password login and no shared fallback key: a launch without a key pair is refused.

The following table shows how a key pair gets into an instance.

| From | Step | To |
| --- | --- | --- |
| Imported public key or generated key pair | becomes | Key pair |
| Key pair | named at launch | Instance login user |
| You with the private key | SSH | Instance login user |

## Key concepts [#key-concepts]

| Concept | Meaning |
| --- | --- |
| Imported key pair | You upload the public half of a key you already have. The private key never leaves your machine. Accepted key types are `ssh-ed25519`, `ssh-rsa`, `ssh-dss` and `ecdsa-sha2-nistp256`, `-nistp384` and `-nistp521`. |
| Generated key pair | The platform generates an `ssh-ed25519` key pair and returns the private key in the response, once. The platform stores only the public half, so the private key can never be retrieved again. |
| Login user | The account the public key is installed for. See [Guest environment](/docs/compute/instances/guest-environment). |

## What you can do [#what-you-can-do]

- [Create a key pair](/docs/compute/key-pairs/create), by importing or generating it
- List key pairs with `origin compute list-key-pairs` and read one with `origin compute get-key-pair`
- Delete a key pair with `origin compute delete-key-pair`

Deleting a key pair doesn’t change instances already launched with it. Their login user keeps the public key, and the matching private key still logs in. You can no longer launch new instances with it.

## Related [#related]

- [Launch an instance](/docs/compute/instances/launch)
- [origin compute commands](/docs/compute/reference/cli)