How to manage multiple GitHub accounts with different SSH keys

I use my private computer to work with repositories belonging to several clients. Some projects are hosted under my personal GitHub account, while others belong to separate organizations or customer accounts.

Using one SSH key everywhere would be convenient, but it would also create an unnecessary security risk. Separate keys make access easier to manage and revoke. If cooperation with a client ends or one key is compromised, I can disable that specific key without affecting access to my other projects.

This configuration also prevents Git from accidentally authenticating with the wrong GitHub account.

Generate separate SSH keys

Create a dedicated key for each account or client:

ssh-keygen -t ed25519 -C "personal-github" \ -f ~/.ssh/id_ed25519_github_personal

ssh-keygen -t ed25519 -C "client-name" \ -f ~/.ssh/id_ed25519_github_client

Use a passphrase, especially when the key is stored on a personal computer.

The command creates two files for each key:

• id_ed25519_github_personal (the private key)
• id_ed25519_github_personal.pub (the public key)

The file ending in .pub is the public key that you add to GitHub. The file without an extension is private and should never be shared.

Add the public keys to GitHub

Display the public key for each account:

cat ~/.ssh/id_ed25519_github_personal.pub

cat ~/.ssh/id_ed25519_github_client.pub

Open GitHub and navigate to:

Settings -> SSH and GPG keys -> New SSH key

Add the personal key to your personal account and the client key to the appropriate client account.

Configure SSH aliases

Add the following aliases to your ~/.ssh/config file:

```bash Host github-personal HostName github.com User git IdentityFile ~/.ssh/id_ed25519_github_personal IdentitiesOnly yes AddKeysToAgent yes UseKeychain yes

Host github-client HostName github.com User git IdentityFile ~/.ssh/id_ed25519_github_client IdentitiesOnly yes AddKeysToAgent yes UseKeychain yes ```

_github-personal_ and _github-client_ are local aliases. Both connect to github.com, but SSH uses a different key for each connection.

_UseKeychain yes_ is intended for macOS. On Linux, remove this option.

Configure repository URLs

For a personal repository, use the personal alias:

git clone git@github-personal:username/repository.git

For a client repository, use the client alias:

git clone git@github-client:client-organization/repository.git

For an existing repository, update its remote URL:

git remote set-url origin \
  git@github-client:client-organization/repository.git

You can verify the configured remote with:

git remote -v

Configure the correct commit author

SSH determines which account can access a repository, but it does not control the author information stored in commits.

Configure it separately inside each repository:

git config user.name "Your Name"
git config user.email "[email protected]"

Verify the configuration:

git config user.name
git config user.email

This is particularly important when personal and work projects require different emails.

Using separate SSH keys on a dedicated server

The same SSH alias configuration can be used on a dedicated server. However, servers should generally use keys created specifically for deployments rather than personal SSH keys copied from a developer’s computer.

Generate a separate key on the server:

ssh-keygen -t ed25519 -C "production-deploy" \
  -f ~/.ssh/id_ed25519_project_deploy

Then configure an alias:

Host github-project-deploy
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_project_deploy
    IdentitiesOnly yes

The repository can use this remote:

git@github-project-deploy:organization/repository.git

For stronger isolation, add the public key to the relevant GitHub repository as a Deploy key:

Repository -> Settings -> Deploy keys

Deploy keys can be limited to a single repository and configured as read-only. This is usually sufficient when a production server only needs to pull application code.

The main advantages are:

• a compromised server key does not expose every repository available to a developer;
• access can be revoked for one server or project;
• development and deployment credentials remain separate;
• read-only access reduces the risk of unauthorized changes;
• key rotation and access auditing become easier.

A regular SSH key added to a GitHub account inherits that account’s repository access. Therefore, if you need true project-level isolation, use a repository deploy key, a dedicated machine account with limited permissions or a GitHub App.

Summary

Separate SSH keys provide a simple way to isolate personal, client and deployment access. SSH aliases make the setup transparent to Git, while repository-specific deploy keys offer stronger protection on production servers.

It requires a little more configuration initially, but makes access control, revocation and credential rotation considerably safer.