Introduction

Permission denied (publickey) during a Heroku Git push means the SSH authentication step failed before your code was even considered for deployment. The follow-up line fatal: The remote end hung up unexpectedly is usually just the downstream symptom of that failed handshake.

The fastest way to fix the issue is to verify three things in order: your local SSH key, your Heroku account's registered keys, and the Git remote URL you are pushing to.

What Heroku Git Pushes Depend On

When you run git push heroku main, Git connects to Heroku over SSH. For that to work, your machine must have a private key loaded, the matching public key must be registered with the correct Heroku account, and the heroku remote must point at the intended app.

If any of those pieces are wrong, authentication fails before Heroku even reaches the build stage.

Check Local SSH Keys

Start by listing the keys available on your machine:

ls -la ~/.ssh

If you do not already have a key pair you want to use, generate one:

ssh-keygen -t ed25519 -C "[email protected]"

Then load it into the SSH agent:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

At this point, your machine is ready to offer the key to Heroku, but Heroku still has to know about the matching public key.

Register The Public Key With Heroku

Upload the public key using the Heroku CLI:

heroku keys:add ~/.ssh/id_ed25519.pub

You can see which keys are currently associated with your account:

heroku keys

If you use multiple Heroku accounts, confirm that the CLI is logged into the correct one before adding the key. That is a frequent source of confusion on shared laptops and consulting setups.

Verify The Remote And The SSH Handshake

Next, inspect the Git remote:

git remote -v

You should see something like this:

heroku  [email protected]:your-app-name.git (fetch)
heroku  [email protected]:your-app-name.git (push)

If the remote is wrong, reset it with the app name you actually want:

heroku git:remote -a your-app-name

Then test SSH directly with verbose output:

ssh -v [email protected]

That output shows which key SSH is offering and whether Heroku is accepting it. It is much more useful than retrying random pushes.

Retry The Push Cleanly

Once the key and remote look correct, retry the deployment:

git push heroku main

If your project still uses master, push that branch explicitly instead:

git push heroku master

Branch selection and SSH authentication are separate concerns, so fix the authentication error first and then worry about branch naming.

Common Pitfalls

The biggest mistake is treating fatal: The remote end hung up unexpectedly as the root cause. In this specific case, the real problem is almost always the earlier SSH denial.

Another pitfall is having a working SSH key locally but never uploading the public key to Heroku, or uploading it to the wrong Heroku account.

A third issue is forgetting that SSH may offer multiple keys. If the wrong key is presented first, Heroku can reject the connection even though the correct key exists on disk. The verbose ssh -v output is the quickest way to see that mismatch.

Summary

• 'Permission denied (publickey) means Heroku rejected the SSH key used for Git authentication.'
• The remote-hung-up message is usually a consequence, not the primary failure.
• Make sure a local key exists, is loaded into the agent, and is registered with the right Heroku account.
• Verify the heroku remote before retrying the push.
• Use verbose SSH output to see exactly which key is being offered.