> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gravixlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH Key Rotation

> Regenerate SSH keys for a runtime

Rotate keys when credentials may have been exposed, or as part of regular security policy.

`POST /v1/agents/runtime/{runtime_id}/ssh/enable?regenerate_keys=true`

<CodeGroup>
  ```python Python theme={"theme":{"light":"github-light","dark":"github-dark"}}
  from gravixlayer import GravixLayer

  client = GravixLayer()  # defaults to cloud="aws", region="us-east-1"
  sandbox = client.runtime.create()  # defaults to template="base-small"

  initial = sandbox.enable_ssh()
  print("Initial connect:", initial.connect_cmd)

  rotated = sandbox.enable_ssh(regenerate_keys=True)
  print("New connect:", rotated.connect_cmd)

  sandbox.kill()
  ```

  ```typescript TypeScript theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import { GravixLayer } from 'gravixlayer';

  const client = new GravixLayer(); // defaults to cloud="aws", region="us-east-1"
  const sandbox = await client.runtime.create(); // defaults to template="base-small"

  const initial = await sandbox.enableSsh();
  console.log('Initial connect:', initial.connectCmd);

  const rotated = await sandbox.enableSsh({ regenerateKeys: true });
  console.log('New connect:', rotated.connectCmd);

  await sandbox.kill();
  ```

  ```bash CLI theme={"theme":{"light":"github-light","dark":"github-dark"}}
  gravixlayer runtime ssh enable "$RT" --output json | jq -r '.connect_cmd'

  gravixlayer runtime ssh enable "$RT" --regenerate-keys --output json | jq -r '.connect_cmd'
  ```

  ```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
  curl -sS -X POST "https://api.gravixlayer.ai/v1/agents/runtime/$RT/ssh/enable" \
    -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{}' | jq .

  curl -sS -X POST "https://api.gravixlayer.ai/v1/agents/runtime/$RT/ssh/enable?regenerate_keys=true" \
    -H "Authorization: Bearer $GRAVIXLAYER_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{}' | jq .
  ```
</CodeGroup>

## Recommended Flow

1. Call `enable_ssh` with `regenerate_keys=True` (CLI: `--regenerate-keys`).
2. Distribute the new private key to authorized operators.
3. Remove old local key files.
4. Verify access using the new `connect_cmd`.