pickey 0.3.3

Automatic SSH key selection for git
pickey-0.3.3 is not a library.

πŸ”‘πŸ€ pickey

/ˈpΙͺkiː/

Two GitHub accounts, one laptop? pickey picks the right SSH key, automatically!

  • πŸ”‘ Automatic SSH key selection β€” rules match by host, org, or repo path
  • πŸ‘€ Observable β€” every git push / pull shows which key is being used
  • ⚑ Fast β€” single static Rust binary, no runtime dependencies
  • πŸ€– Just works β€” at clone time, from /tmp, from AI agent terminals, any shell
$ git push
[πŸ”‘πŸ€] git@github.com:WORK/my-api.git β†’ ~/.ssh/id_work
Pushing…

Install

Homebrew

brew install simeoncode/tap/pickey
pickey init # --dry-run (to only preview changes)

Cargo

cargo install pickey --locked
pickey init # --dry-run (to only preview changes)

Prebuilt Binary

curl -fsSL https://raw.githubusercontent.com/simeoncode/pickey/main/install.sh | sh
…
pickey init # --dry-run (to only preview changes)

Usage

pickey [status]           # Shows pickey status + current repo
pickey init               # Enable pickey
pickey init --dry-run     # Preview activation changes
pickey init --revert      # Undo changes made by init
pickey list               # List all rules
pickey check <url>        # See matching rules for URL
pickey test               # Test SSH connection

Configuration

~/.config/pickey/config.toml:

[[rule]]
host = "github.com"
match = "WORK-Internal/*"
key = "~/.ssh/id_work"
email = "email@work.com"
name = "My Name"

[[rule]]
host = "github.com"
match = "MyPersonalOrg/*"
key = "~/.ssh/id_personal"

Rules auto-detected by pickey init include auto = true β€” these are safely replaced when you re-run init. Manually added rules (without auto = true) are always preserved.

Rules are evaluated top-to-bottom, first match wins. match is a glob pattern against the full path after the host. If no rule matches, pickey falls through to plain ssh (with a warning).

Fields

Field Required? Description
auto This rule was auto-generated by pickey init
host yes Exact match against the SSH hostname
match Glob against the path after the host. Omit to match any path on that host
key yes Path to private key (~ expansion supported)
port SSH port override (for non-standard ports)
email Sets repo-local user.email β€” see why
name Sets repo-local user.name

How it works

pickey sits as git's sshCommand. When git calls SSH, pickey matches the remote against your rules and injects -i <key> with -o IdentityAgent=none β€” so the right key is used and the ssh-agent can't override it. That's the whole trick.