Introduction

If you use Git with multiple hosts or multiple accounts, you often need different SSH keys for different domains or host aliases. The clean way to do that is not inside Git itself, but in your SSH client configuration.

Git delegates SSH authentication to ssh, so the real control point is ~/.ssh/config. Once SSH knows which key to use for a given host or alias, git push follows that configuration automatically.

The Standard SSH Config Pattern

A basic host entry looks like this:

1Host github-work
2    HostName github.com
3    User git
4    IdentityFile ~/.ssh/id_ed25519_work
5    IdentitiesOnly yes

This says:

• the alias github-work should connect to github.com
• the SSH user is git
• the selected private key is ~/.ssh/id_ed25519_work
• only that identity should be offered

Now set the repository remote to use the host alias instead of the raw domain.

git remote set-url origin git@github-work:my-org/my-repo.git

After that, git push uses the key configured for github-work.

Why the Alias Matters

If you keep using [email protected]:owner/repo.git, SSH matches the plain github.com host entry. That means you cannot distinguish two different accounts for the same domain unless you introduce aliases such as github-work and github-personal.

Example:

1Host github-personal
2    HostName github.com
3    User git
4    IdentityFile ~/.ssh/id_ed25519_personal
5    IdentitiesOnly yes
6
7Host github-work
8    HostName github.com
9    User git
10    IdentityFile ~/.ssh/id_ed25519_work
11    IdentitiesOnly yes

Then different repositories can use different remotes:

git remote set-url origin git@github-personal:yourname/project.git

or:

git remote set-url origin git@github-work:company/project.git

Test the SSH Mapping

Before debugging Git, test the SSH configuration directly.

ssh -T git@github-work

If the alias and key are configured correctly, the host should recognize the intended account.

This is the fastest way to separate SSH configuration issues from Git remote issues.

Domain-Level Configuration Without Aliases

If you truly want one key for one domain and no special aliasing, you can configure the real host name directly.

1Host gitlab.example.com
2    User git
3    IdentityFile ~/.ssh/id_ed25519_gitlab
4    IdentitiesOnly yes

That works when one domain maps cleanly to one identity. Aliases become necessary mainly when multiple identities share the same underlying host name.

Optional: Force a Key Per Repository Command

There are also per-command or per-repository overrides, but they are usually less maintainable than SSH config.

For example:

GIT_SSH_COMMAND='ssh -i ~/.ssh/id_ed25519_work -o IdentitiesOnly=yes' git push

This works, but it is better as a temporary override than as the long-term default. The SSH config file is clearer and easier to reuse.

File Permissions and Agent Use

Your private key and config should also have reasonable permissions.

chmod 600 ~/.ssh/id_ed25519_work
chmod 600 ~/.ssh/config

If you use an SSH agent, add the key there too if desired:

ssh-add ~/.ssh/id_ed25519_work

The agent is optional when the SSH config points to the correct key, but it can make repeated authentication smoother.

Common Pitfalls

One common mistake is configuring a host alias in ~/.ssh/config but leaving the Git remote pointing at the original raw domain name. In that case, the alias is never used.

Another issue is forgetting IdentitiesOnly yes. Without it, SSH may offer extra keys from the agent, which can make authentication look inconsistent.

It is also easy to test with ssh -T [email protected] when the repository actually uses the alias github-work. Test the exact host string that the Git remote uses.

Finally, keep the SSH key problem and the Git remote problem separate. Git push authentication is often correct as soon as SSH is configured correctly.

Summary

• The normal way to choose an SSH key for git push is through ~/.ssh/config.
• Use Host aliases when the same domain must support multiple identities.
• Point the Git remote at the alias, not just the real host name.
• Test with ssh -T against the exact alias to verify the mapping.
• 'GIT_SSH_COMMAND works for temporary overrides, but SSH config is usually the cleaner long-term solution.'