iOS Codex: "Add SSH Host" only supports password authentication, missing identity file / key-based auth

What variant of Codex are you using?

App (ChatGPT iOS, Codex feature — Connections)

What issue are you seeing?

The "Add SSH Host" form in the iOS ChatGPT app's Codex Connections only provides a Password field for SSH authentication. There is no option to specify an Identity File (private key) or use SSH agent forwarding.

!iOS Codex Add SSH Host — password only

The form currently has these fields:

• Icon
• Display name
• Host
• Port (default 22)
• Username
• Password (Required)

No Identity File / Private Key field is present.

Why this matters

In production and enterprise environments, password-based SSH authentication is almost always disabled for security reasons. Standard practice is to use key-based authentication (PubkeyAuthentication yes, PasswordAuthentication no).

This means the iOS Codex Connections feature is effectively unusable for connecting to any properly secured production server.

Expected behavior

The "Add SSH Host" form should support at least one of the following key-based authentication methods:

1. Identity File — allow the user to select or paste a private key file (e.g. id_ed25519, id_rsa)
2. SSH Agent — leverage the system's SSH agent if available
3. Respect ~/.ssh/config — auto-detect IdentityFile directives from the user's SSH config (as the desktop app partially does, though imperfectly — see #18301)

The ideal UX would be:

• Add an "Authentication Method" toggle: Password / Key File
• When "Key File" is selected, show a file picker or text area for the private key
• Optionally allow specifying a passphrase for encrypted keys

Related issues

• #18301 — Desktop app SSH defaults to id_rsa even when using id_ed25519
• #18114 — Feature request for SSH remote development (mentions "password, key file, or agent forwarding")
• #20636 — SSH remote with key auth silently fails on macOS-to-macOS

Environment

• Platform: iOS (ChatGPT app, Codex feature)
• Remote host: Linux server with key-only SSH authentication