> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anonalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign an SSH certificate

> Signs an OpenSSH user certificate for the given public key. It is valid
for 10 minutes, for this sandbox only, and logs in as `user`. It permits a
PTY and port forwarding, so `ssh -L/-R`, `scp`, `rsync` and editor remote
extensions work. Connect through the stream relay with
`ProxyCommand anona-compute ssh --proxy <sandbox id>`.

Needs an API key or a dashboard role of member or above, with the
`sandboxes:use` scope.




## OpenAPI

````yaml /compute/api-reference/anona-openapi.yaml post /v1/sandboxes/{sandboxID}/ssh-certs
openapi: 3.0.3
info:
  title: Anona Compute API (Anona routes)
  version: 0.1.0
  description: >
    Routes the Anona Compute gateway serves next to the E2B-compatible API:

    live-view viewer tokens, SSH certificates, network policy, the credential

    vault, usage and billing, webhooks and telemetry export, thumbnails, preview
    links,

    public ports, pause when idle, template builds, and API key management.


    Written from the gateway handlers
    (`gateway/internal/stream/token/handlers.go`,

    `gateway/internal/sshca/handler.go`,
    `gateway/internal/handlers/apikeys/apikeys.go`)

    and checked against a running gateway by
    `docs-site/scripts/verify_openapi.py`.
servers:
  - url: https://api.compute.anonalabs.com
security:
  - ApiKeyAuth: []
  - BearerAuth: []
tags:
  - name: Live view
  - name: SSH
  - name: Sandbox access
  - name: Templates
  - name: Network
  - name: Credential vault
  - name: Usage and billing
  - name: Webhooks and telemetry
  - name: API keys
  - name: Service
paths:
  /v1/sandboxes/{sandboxID}/ssh-certs:
    post:
      tags:
        - SSH
      summary: Sign an SSH certificate
      description: >
        Signs an OpenSSH user certificate for the given public key. It is valid

        for 10 minutes, for this sandbox only, and logs in as `user`. It permits
        a

        PTY and port forwarding, so `ssh -L/-R`, `scp`, `rsync` and editor
        remote

        extensions work. Connect through the stream relay with

        `ProxyCommand anona-compute ssh --proxy <sandbox id>`.


        Needs an API key or a dashboard role of member or above, with the

        `sandboxes:use` scope.
      operationId: createSshCertificate
      parameters:
        - $ref: '#/components/parameters/sandboxID'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - publicKey
              additionalProperties: false
              properties:
                publicKey:
                  type: string
                  description: >-
                    OpenSSH public key (`ssh-ed25519`, `ecdsa-sha2-nistp256` or
                    `ssh-rsa`).
                  example: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA... you@laptop
      responses:
        '200':
          description: The signed certificate and how to connect.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshCertificate'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    sandboxID:
      name: sandboxID
      in: path
      required: true
      schema:
        type: string
  schemas:
    SshCertificate:
      type: object
      required:
        - certificate
        - user
        - host
        - proxyCommand
        - expiresAt
      properties:
        certificate:
          type: string
          description: >-
            OpenSSH certificate (`ssh-ed25519-cert-v01@openssh.com ...`); save
            it as `<key>-cert.pub`.
        user:
          type: string
          example: user
        host:
          type: string
          description: The sandbox ID, used as the SSH host name.
        proxyCommand:
          type: string
          example: anona-compute ssh --proxy sbx_123
        expiresAt:
          type: string
          format: date-time
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: integer
          description: The HTTP status code.
        message:
          type: string
        error_code:
          type: string
          description: >-
            Machine-readable reason, on some errors (for example
            `invalid_request`).
  responses:
    BadRequest:
      description: The request body is invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: No valid API key or session.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: The key's scopes or the caller's role do not allow this.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: >-
        Not found, or not yours (the answer is the same, so IDs cannot be
        probed).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: An Anona Compute API key (`e2b_` followed by lowercase hex).
    BearerAuth:
      type: http
      scheme: bearer
      description: 'The same API key, sent as `Authorization: Bearer e2b_...`.'

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.