> ## Documentation Index > Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > Create a new SSH credential for authenticating connections to SSH backends. # Create ## OpenAPI ````yaml post /ssh_credentials openapi: 3.0.0 info: title: ngrok OpenAPI version: 1.0.0 description: > The ngrok REST API at https://api.ngrok.com provides programmatic access to provision and configure every ngrok resource: endpoints, domains, API keys, IP policies, tunnels, certificates, and more. Full documentation: https://ngrok.com/docs/api **Authentication:** Send an API key as a bearer token: "Authorization: Bearer {API key}". Create and revoke keys at https://dashboard.ngrok.com/api-keys or via the /api_keys resource. Requests without credentials receive an error with code ERR_NGROK_200. **Versioning and deprecation policy:** Every request must include the "ngrok-version: 2" header; a missing header returns HTTP 400 with error code ERR_NGROK_218. Version 2 is the current version; all earlier versions are deprecated. ngrok never makes breaking changes to a published API version. Breaking changes ship only as a new version that clients explicitly opt in to via this header. Additive changes (new resources, methods, and fields, and bug fixes that match documented behavior) may ship to a live version. Full policy: https://ngrok.com/docs/api#versioning-and-api-stability **Rate limits:** By default, the API allows 120 requests per rolling 60-second window per account; some plans have higher limits. Exceeding the limit returns HTTP 429 with error code ERR_NGROK_226; wait for the window to pass before retrying. Details: https://ngrok.com/docs/errors/err_ngrok_226 **Errors:** Every 4xx and 5xx response carries the Error schema: the status_code, a human-readable msg, and in most cases a globally unique machine-readable error_code and a details object. Every error code is documented at https://ngrok.com/docs/errors servers: - url: https://api.ngrok.com security: - authentication: [] paths: /ssh_credentials: post: tags: - SSHCredentials summary: Create description: > Create a new ssh_credential from an uploaded public SSH key. This ssh credential can be used to start new tunnels via ngrok's SSH gateway. operationId: SshCredentialsCreate parameters: - $ref: '#/components/parameters/ngrokVersion' requestBody: content: application/json: schema: $ref: '#/components/schemas/SSHCredentialCreate' responses: '201': description: > Create a new ssh_credential from an uploaded public SSH key. This ssh credential can be used to start new tunnels via ngrok's SSH gateway. content: application/json: schema: $ref: '#/components/schemas/SSHCredential' 4XX: $ref: '#/components/responses/Error' 5XX: $ref: '#/components/responses/Error' components: parameters: ngrokVersion: name: ngrok-version in: header required: true schema: type: integer default: 2 schemas: SSHCredentialCreate: type: object required: - public_key properties: description: description: > human-readable description of who or what will use the ssh credential to authenticate. Optional, max 255 bytes. type: string metadata: description: > arbitrary user-defined machine-readable data of this ssh credential. Optional, max 4096 bytes. type: string acl: description: > optional list of ACL rules. If unspecified, the credential will have no restrictions. The only allowed ACL rule at this time is the `bind` rule. The `bind` rule allows the caller to restrict what domains, addresses, and labels the token is allowed to bind. For example, to allow the token to open a tunnel on example.ngrok.io your ACL would include the rule `bind:example.ngrok.io`. Bind rules for domains may specify a leading wildcard to match multiple domains with a common suffix. For example, you may specify a rule of `bind:*.example.com` which will allow `x.example.com`, `y.example.com`, `*.example.com`, etc. Bind rules for labels may specify a wildcard key and/or value to match multiple labels. For example, you may specify a rule of `bind:*=example` which will allow `x=example`, `y=example`, etc. A rule of `'*'` is equivalent to no acl at all and will explicitly permit all actions. type: array items: type: string public_key: description: > the PEM-encoded public key of the SSH keypair that will be used to authenticate type: string owner_id: description: > If supplied at credential creation, ownership will be assigned to the specified User or Bot. Only admins may specify an owner other than themselves. Defaults to the authenticated User or Bot. type: string SSHCredential: type: object properties: id: description: | unique ssh credential resource identifier type: string uri: description: | URI of the ssh credential API resource type: string created_at: description: | timestamp when the ssh credential was created, RFC 3339 format type: string description: description: > human-readable description of who or what will use the ssh credential to authenticate. Optional, max 255 bytes. type: string metadata: description: > arbitrary user-defined machine-readable data of this ssh credential. Optional, max 4096 bytes. type: string public_key: description: > the PEM-encoded public key of the SSH keypair that will be used to authenticate type: string acl: description: > optional list of ACL rules. If unspecified, the credential will have no restrictions. The only allowed ACL rule at this time is the `bind` rule. The `bind` rule allows the caller to restrict what domains, addresses, and labels the token is allowed to bind. For example, to allow the token to open a tunnel on example.ngrok.io your ACL would include the rule `bind:example.ngrok.io`. Bind rules for domains may specify a leading wildcard to match multiple domains with a common suffix. For example, you may specify a rule of `bind:*.example.com` which will allow `x.example.com`, `y.example.com`, `*.example.com`, etc. Bind rules for labels may specify a wildcard key and/or value to match multiple labels. For example, you may specify a rule of `bind:*=example` which will allow `x=example`, `y=example`, etc. A rule of `'*'` is equivalent to no acl at all and will explicitly permit all actions. type: array items: type: string owner_id: description: > If supplied at credential creation, ownership will be assigned to the specified User or Bot. Only admins may specify an owner other than themselves. Defaults to the authenticated User or Bot. type: string Error: type: object description: > The error body every api.ngrok.com 4xx and 5xx response returns. Every error condition has a globally unique, documented error code; see https://ngrok.com/docs/errors required: - status_code - msg properties: error_code: description: > Globally unique machine-readable error code, for example ERR_NGROK_226. Each code is documented at https://ngrok.com/docs/errors/reference. Omitted on transport-level errors such as a plain 404 for an unknown path. type: string status_code: description: | The HTTP status code of the response, duplicated in the body. type: integer msg: description: | Human-readable description of the error and how to resolve it. type: string details: description: > Additional error context. details.operation_id identifies the failed request when contacting support. type: object additionalProperties: type: string responses: Error: description: > An error. The body carries a machine-readable error_code and a human-readable msg; every code is documented at https://ngrok.com/docs/errors. A 429 with error code ERR_NGROK_226 means the account exceeded the documented request-rate limit. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: authentication: type: http scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.