Better key authentication on SSH host remote connections on the Desktop and iOS apps

Open 💬 14 comments Opened May 15, 2026 by rainx0r

What variant of Codex are you using?

App, Mobile, CLI

What feature would you like to see?

Thank you for your hard work on the remote connections feature, it seems really well thought out! I'm keen to start using it to remote control CLI hosts over ssh from the iOS app, but currently the "Add SSH Host" dialogue seems to only support password authentication. The server I want to connect to strictly has password authentication disabled, which is a very common hardened box setup. It would be nice if the app supported providing an SSH key from the filesystem. This is possible on a lot of ssh client apps on iOS so it should be feasible for the ChatGPT / Codex app too.

Additionally key authentication in the desktop app (for macOS) also doesn't work with keys that have a password attached to them it seems. Perhaps this could be documented as a limitation. How this is handled in other software with remote SSH connections is just prompting the user for the password on disconnect/reconnect, but I understand if that's not a UX flow you want to support.

Additional information

_No response_

View original on GitHub ↗

14 Comments

Taiki92777 · 2 months ago

@rainx0r
Sharing a workaround that worked for me, in case it helps anyone blocked on the iOS-side key-auth limitation.

I didn't configure SSH on mobile at all. Instead:

On my local desktop, I used the Codex desktop app's remote connections to SSH into the remote instance.
I'm signed into the same Codex account on both the local machine and the remote instance.
I then signed into the Codex mobile app with that same account and followed the prompt that the desktop app surfaces. The mobile app picked up the remote instance and I could drive it from my phone — without ever adding an SSH host on mobile.

JulianBerger · 2 months ago

in Connections -> Details you can enable "Available from signed-in devices" for SSH Remote Hosts that then will be available on mobile!

kamusis · 2 months ago

+1 on this. Ran into the exact same issue — connecting from the iOS ChatGPT app to a production server with PasswordAuthentication no is impossible.

Adding a screenshot of the current "Add SSH Host" form for reference — only a Password field, no identity file option:

!iOS Codex Add SSH Host

Also want to note: this is a blocker for enterprise / production use cases. Key-based auth is not a nice-to-have, it is the only allowed method in any hardened environment.

kamusis · 2 months ago

in Connections -> Details you can enable "Available from signed-in devices" for SSH Remote Hosts that then will be available on mobile!

Thanks so much! This tip is a lifesaver. However, I noticed that the "Available from signed-in devices" setting is currently only present in the macOS Codex app, and completely missing from the Windows app. This seems to be a feature parity gap, so I trust it will be added to the Windows version soon.

Snailflyer · 2 months ago

This looks like two separate product paths that should probably be explicit in the UI:

mobile creates the SSH connection itself, so the mobile app needs key import/passphrase/agent/storage/revocation semantics;
desktop owns the SSH connection, and mobile only controls an already-configured desktop/remote project through the signed-in device path.

For hardened servers, the second model may be safer because the private key can stay on the desktop or enterprise-managed host. But then the mobile UI must clearly show that commands execute through the desktop-owned remote project, not from the phone as an SSH client.

The dangerous ambiguous state is: mobile appears to "have" the SSH host, but the user cannot tell which credential is used, where the key material lives, whether the passphrase prompt can be re-raised after reconnect, and which device revocation actually cuts off access. Those are security boundaries, not just UX details.

rapind · 1 month ago

The mobile app needs SSH key support -OR- we need to be able to route securely through Codex like Claude Code's /remote-control command.

Former is probably easier to add but worse DX (IMO this is OK for me, but will limit your audience). Recommend checking out the CC remote-control feature for inspiration.

htko89 · 1 month ago

The mobile app needs SSH key support -OR- we need to be able to route securely through Codex like Claude Code's /remote-control command. Former is probably easier to add but worse DX (IMO this is OK for me, but will limit your audience). Recommend checking out the CC remote-control feature for inspiration.

I quite like Codex's connect once per machine connection over claude's per session connection. I really don't like having to initiate the remote-control from the host end first for each session, per project. Maybe I'm doing it wrong and I can initiate from the ios app?

This would be a valid use case for having key based codex ssh auth, as my setup also only relies on ssh keys

bendietze · 1 month ago

It is also important to me that I can easily log in to my ssh from my iPhone while on the go using a key file and passphrase.

Please add this as soon as possible.

m1chaeljmk · 1 month ago

+1 for this, seems strange to only work via non-best-practice username/password

dani190 · 17 days ago

Datakunskap · 13 days ago

Secure key exchange should be integrated into the Mobile QR auth flow ASAP. This is extremely unsecure. I was able to access my MacBook remotely (via iOS) solely with having OpenAI account access (no QR code needed).

Also, preferably e2e encrypted “relay layer” to better protect everyone’s IP 🙏.

htko89 · 6 days ago

there is support for this now, thank you openai!

htko89 · 6 days ago

Nevermind I spoke too soon, only partial support:

OpenSSH private keys are not supported yet. Export an Ed25519 or ECDSA key as PKCS#8 or SEC1 PEM and try again.

bendietze · 5 days ago

🎉 I can confirm that it works now!

I converted my ed25521 to PKCS#8.

Thank you very much 💯