How to configure ssh-agent on Windows and use SSH keys without repeating passwords
Published on 2026-10-26 by frfrand
SSH agent Windows 11, keys and remote authentication on VPS
Every time you SSH into your VPS it asks for the key passphrase again. That's normal if the key is protected, but you don't need to type it on every connection: ssh-agent can keep the key unlocked during the authorized session.
I'll show you where the problem is, how to check it without guessing, and what I'd do in an application that actually has users. You don't need to memorize an entire manual to fix a specific issue.
What ssh-agent means on Windows in practice
The private key stays on your machine; the agent helps the SSH client use it without copying it to the server. Modern Windows can have OpenSSH Client and the ssh-agent service. There are differences depending on service permissions, machine policy, and session type.
A clarification before touching the server: if the project is already in production, save the state you found and check which user and machine you're going to run the commands on. Working as root without need and changing several things at once makes it harder to find the cause of an error.
Useful commands to get started
Get-Service ssh-agent
# En PowerShell elevado, sólo si necesitas configurar el servicio
Set-Service -Name ssh-agent -StartupType Manual
Start-Service ssh-agent
# En una sesión normal, agregar una clave existente
ssh-add "$env:USERPROFILE\.ssh\id_ed25519"
ssh-add -l
ssh usuario@servidorPaths, drive names, and domains are examples. Adapt them to your service. If a command requires administrator permissions, check what changes and why. Diagnostic queries should come before modifications.
Step by step, with checks
- Check that Windows has the OpenSSH client and that a valid key exists.
- Verify the service status; if you need to start it, do so according to your team's policy.
- Add the key with
ssh-add; the passphrase is requested when loading it. - Verify the server's host identity before accepting a connection.
- To revoke the local session, use
ssh-add -Dand check that the agent has been emptied.
After each step, verify an observable result: a status, a file, an HTTP response, or a log entry. If you find an unexpected message, save it for investigation instead of hiding it with repeated restarts.
Real example: an application that needs maintenance
You manage several client VPSs. Each server accepts your individual public key, without sharing the private one. From PowerShell you can open SSH sessions with protected authentication while the agent manages unlocking.
At the end, test the full path: enter via domain, call the API, write a test data point, and verify that the information is still there after a controlled restart. A server that "boots" is not always a working application.
Mistakes worth avoiding
The agent does not make a compromised computer secure. Lock your session, revoke keys when access changes, and never copy id_ed25519 to a chat. Set-Service commands require elevated permissions.
It is also important that credentials do not end up in terminal history, logs, shared files, or screenshots. For users and services, use minimal permissions and document who can revoke access.
How ArduMaker fits into this scenario
In ArduMaker, organize access by VPS and Company, ideally with individual SSH keys. The agent makes it easy to work from Windows without sharing keys with the rest of the team.
ArduMaker can help you manage VPSs, deploy repositories, and work with services, databases, and domains from the same platform. It does not replace what we just explained about Linux: precisely for that reason, it is worth understanding the diagnosis and having a way to repeat it.
When it is worth automating it
If the task is repeated, first document the manual procedure and its checks. Then consider a script or a scheduled task with visible errors, logs, and limited permissions. Do not automate a command that you do not yet know how to recover when something goes wrong.
Frequently asked questions
Can I try it without affecting customers? In many cases, yes: a staging VPS or a separate test service allows you to validate the configuration before changing production.
How do I know it worked? Check logs and a functional operation, not just that the command ended with a zero code.
When do I need more resources? When metrics indicate CPU, RAM, disk, or connection saturation. A configuration failure is rarely fixed by hiring more memory.
References
In one sentence: first understand the error, then change one concrete thing and check its effect. That discipline saves you many hours of support.