# Create a key pair

Import the public half of an SSH key you already have, or have the platform generate a key pair and save its private key from the one response that carries it.

Create a key pair before you launch an instance. Import a key you already have, or have the platform generate one. Importing is the safer default, because the private key never leaves your computer.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- A project to create the key pair in. Key pairs belong to one project.
- The `origin` CLI, signed in. See [CLI access](/docs/platform/access/cli).

</BeforeYouBegin>

## Import an existing key [#import-an-existing-key]

1. If you don’t have a key yet, create one locally:

   ```sh
   ssh-keygen -t ed25519 -f ~/.ssh/origin-cloud
   ```

1. Import its public half. Pass the full OpenSSH public key line:

   ```sh
   origin compute import-key-pair \
     --project-urn <project-urn> \
     --name my-key \
     --public-key "$(cat ~/.ssh/origin-cloud.pub)"
   ```

   A key with an unsupported type, or more than one line, is refused.

1. Verify that the key pair is listed:

   ```sh
   origin compute list-key-pairs --project-urn <project-urn>
   ```

## Generate a key pair [#generate-a-key-pair]

1. Generate the key pair:

   ```sh
   origin compute generate-key-pair \
     --project-urn <project-urn> \
     --name my-key
   ```

   The response contains `privateKey`, an `ssh-ed25519` private key in OpenSSH format.

1. Save `privateKey` to a file right away, and restrict its permissions. To do both in one go, generate the key pair and write `privateKey` straight to a file with `jq`, instead of running the command above on its own:

   ```sh
   origin compute generate-key-pair \
     --project-urn <project-urn> \
     --name my-key \
     | jq -r '.. | .privateKey? // empty' > ~/.ssh/origin-cloud
   chmod 600 ~/.ssh/origin-cloud
   ```

   <Callout type="warning" title="Important">

   The private key is returned only in this response. The platform doesn’t store it and can’t show it again. If you lose it, delete the key pair and create a new one.

   </Callout>

1. Verify that the key pair is listed:

   ```sh
   origin compute list-key-pairs --project-urn <project-urn>
   ```

## Using the API [#using-the-api]

The `importKeyPair` and `generateKeyPair` mutations take the same inputs. Request `privateKey` in the `generateKeyPair` selection, or you can’t get it later:

```graphql
mutation {
  compute {
    generateKeyPair(input: { projectUrn: "<project-urn>", name: "my-key" }) {
      urn
      publicKey
      privateKey
    }
  }
}
```

## Next steps [#next-steps]

- [Launch an instance](/docs/compute/instances/launch) with the key pair

## Related [#related]

- [`import-key-pair` reference](/docs/compute/reference/cli#import-key-pair)
- [`generate-key-pair` reference](/docs/compute/reference/cli#generate-key-pair)
- [Key pairs](/docs/compute/key-pairs)