Connecting with Your SSH Client

Besides the in-browser Web Terminal, you can reach your assets with your own SSH client. Authentication with your own SSH client uses public keys (the gateway also accepts password + OTP and web approval). You prove possession of your private key, and WingGate never holds it.

Prerequisites

A WingGate account with MFA enrollment completed (TOTP or passkey).
An active Project access grant on the Project that contains the asset. The asset must support the SSH client entrypoint.
The asset's SSH host key confirmed (see below).
An online connector that can reach the asset.

Register your public key

Generate a key pair if you do not have one:
```
ssh-keygen -t ed25519
```
In the web console, open your account's SSH key area and add the public key. Never paste a private key anywhere; WingGate only stores public keys.

Confirm the host key

Before the first SSH connection to an asset, WingGate probes the target host's SSH host key and asks you to confirm it. Verify the fingerprint out of band, then confirm. The key is pinned afterwards: a later mismatch is flagged instead of silently accepted. If a host was rebuilt or re-addressed, re-probe and confirm deliberately — never override a mismatch you cannot explain.

Connect

Point your SSH client at WingGate's SSH endpoint; the service authenticates your key, checks the grant, and forwards the session through the wing-connector to the asset:

ssh <user>@<hub-ssh-endpoint>

The exact endpoint address and port depend on your deployment.

This entry serves two flows. Interactive shell: run it without a command and WingGate lists your authorized assets, then opens the shell you pick. CLI SFTP: ssh -s '<user>@<asset>'@<hub-ssh-endpoint> sftp — the asset selector in the login name must match exactly one asset in your authorized set; a missing, ambiguous or unauthorized selector is refused. The connector's local SSH Direct listener does not serve SFTP. Requests that carry a command (ssh <user>@<hub-ssh-endpoint> <command>, the exec channel) are still refused with a message pointing back at interactive login — WingGate neither parses nor runs client commands.

Alternative: SSH Direct to a connector

If the wing-connector that serves your asset has SSH Direct enabled, you can also point your SSH client at the connector's local SSH listener and connect to the asset from there — the connector authenticates you through WingGate and lists the assets your grants authorize.

The SSH entry on each SSH asset row in the Project overview gives you a copyable connection command: an asset bound to an executor prefers that connector's address; an unbound asset falls back to an organization wing-connector with SSH Direct enabled (online preferred). The command prefers the connector's advertised address (set by the connector operator in the SSH Direct configuration; display-only, never used for binding); without an advertised address it falls back to the listen address, and a loopback address is explicitly flagged as usable only on the connector host. When no connector in the organization has SSH Direct enabled, there is no direct endpoint — use the gateway path above instead. The listen address and accepted authentication methods are set by the connector operator; see connectors for the setup, and Connection model for the shared boundary.

Expected result

A shell opens on the target host. The session appears in your Organization's audit view with you as the actor.

The terminal window title switches to the asset (name, address, organization/project, plus the login username when the asset has several identities), so several session tabs stay distinguishable.

If the connection fails

Check in this order:

Authentication — is the public key registered on your account, and is the client offering the matching private key (ssh -v shows which keys are tried)?
Authorization — does the member have an active grant for this Project, and does the asset belong to the Project and support the SSH client entry?
Host key — is the asset's host key confirmed, or is there an unresolved mismatch?
connector — is the connector that serves the asset online?
Credential — does the asset's connection profile hold a valid credential for the target host?