/usr/bin/ssh-add --help — Chainguard OS Manuals

From openssh-client 10.6_p2-r0 (os), captured 2026-11-10 by running ssh-add --help (exit 1). permalink

unknown option -- -
usage: ssh-add [-CcDdKkLlqvXx] [-E fingerprint_hash] [-H hostkey_file]
               [-h destination_constraint] [-S provider] [-t life]
               [file ...]
       ssh-add -s pkcs11 [-Cv] [certificate ...]
       ssh-add -e pkcs11
       ssh-add -T pubkey ...

Options (23)

Option	Description	Source
`-C`	When loading keys into or deleting keys from the agent, process certificates only and skip plain keys.	man
`-c`	Indicates that added identities should be subject to confirmation before being used for authentication.	man
`-D`	Deletes all identities from the agent.	man
`-d`	Instead of adding identities, removes identities from the agent.	man
`-E` fingerprint_hash	Specifies the hash algorithm used when displaying key fingerprints.	man
`-e` pkcs11	Remove keys provided by the PKCS#11 shared library pkcs11.	man
`-H` hostkey_file	Specifies a known hosts file to look up hostkeys when using destination-constrained keys via the -h flag.	man
`-h` destination_constraint	When adding keys, constrain them to be usable only through specific hosts or to specific destinations.	man
`-K`	Load resident keys from a FIDO authenticator.	man
`-k`	When loading keys into or deleting keys from the agent, process plain private keys only and skip certificates.	man
`-L`	Lists public key parameters of all identities currently represented by the agent.	man
`-P`	When loading PKCS#11 or FIDO keys from a token, do not request a PIN.	man
`-l`	Lists fingerprints of all identities currently represented by the agent.	man
`-N`	When adding certificates, by default ssh-add will request that the agent automatically delete the certificate shortly after the certificate's expiry date.	man
`-Q`	Query the agent for the list of protocol extensions it supports.	man
`-q`	Be quiet after a successful operation.	man
`-S` provider	Specifies a path to a library that will be used when adding FIDO authenticator-hosted keys, overriding the default of using the internal USB HID support.	man
`-s` pkcs11	Add keys provided by the PKCS#11 shared library pkcs11.	man
`-T` pubkey	Tests whether the private keys that correspond to the specified pubkey files are usable by performing sign and verify operations on each.	man
`-t` life	Set a maximum lifetime when adding identities to an agent.	man
`-v`	Verbose mode.	man
`-X`	Unlock the agent.	man
`-x`	Lock the agent with a password.	man

Exit status (3) from the manual page

`0`	success
`1`	the specified command fails
`2`	ssh-add is unable to contact the authentication agent

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.