# authorized_key – Adds or removes an SSH authorized key

- Synopsis
- Parameters
- Examples
- Return Values
- Status

## Synopsis

- Adds or removes SSH authorized keys for particular user accounts.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
comment string added in 2.4 |  | Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab. If no comment is specified, the existing comment will be kept.

exclusive
boolean

Choices:
- no ←
- yes

Whether to remove all other non-specified keys from the authorized_keys file.
Multiple keys can be specified in a single `key` string value by separating them by newlines.
This option is not loop aware, so if you use `with_` , it will be exclusive per iteration of the loop.
If you want multiple keys in the file you need to pass them all to `key` in a single batch as mentioned above.

follow
boolean
added in 2.7

Choices:
- no ←
- yes

Follow path symlink instead of replacing it.

key string / required |  | The SSH public key(s), as a string or (since Ansible 1.9) url (https://github.com/username.keys).
key_options - |  | A string of ssh key options to be prepended to the key in the authorized_keys file.

manage_dir
boolean

Choices:
- no
- yes ←

Whether this module should manage the directory of the authorized key file.
If set to `yes`, the module will create the directory, as well as set the owner and permissions of an existing directory.
Be sure to set `manage_dir=no` if you are using an alternate directory for authorized_keys, as set with `path`, since you could lock yourself out of SSH access.
See the example below.

path path |  | Alternate path to the authorized_keys file. When unset, this value defaults to ~/.ssh/authorized_keys.

state
string

Choices:
- absent
- present ←

Whether the given key (with the given key_options) should or should not be in the file.

user string / required |  | The username on the remote host whose authorized_keys file will be modified.

validate_certs
boolean

Choices:
- no
- yes ←

This only applies if using a https url as the source of the keys.
If set to `no`, the SSL certificates will not be validated.
This should only set to `no` used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
Prior to 2.1 the code worked as if this was set to `yes`.

## Examples

    - name: Set authorized key taken from file
      authorized_key:
        user: charlie
        state: present
        key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"

    - name: Set authorized keys taken from url
      authorized_key:
        user: charlie
        state: present
        key: https://github.com/charlie.keys

    - name: Set authorized key in alternate location
      authorized_key:
        user: charlie
        state: present
        key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
        path: /etc/ssh/authorized_keys/charlie
        manage_dir: False

    - name: Set up multiple authorized keys
      authorized_key:
        user: deploy
        state: present
        key: '{{ item }}'
      with_file:
        - public_keys/doe-jane
        - public_keys/doe-john

    - name: Set authorized key defining key options
      authorized_key:
        user: charlie
        state: present
        key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
        key_options: 'no-port-forwarding,from="10.0.1.1"'

    - name: Set authorized key without validating the TLS/SSL certificates
      authorized_key:
        user: charlie
        state: present
        key: https://github.com/user.keys
        validate_certs: False

    - name: Set authorized key, removing all the authorized keys already set
      authorized_key:
        user: root
        key: '{{ item }}'
        state: present
        exclusive: True
      with_file:
        - public_keys/doe-jane

    - name: Set authorized key for user ubuntu copying it from current user
      authorized_key:
        user: ubuntu
        state: present
        key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
exclusive boolean | success | If the key has been forced to be exclusive or not.
key string | success | The key that the module was running against. Sample: https://github.com/user.keys
key_option string | success | Key options related to the key.
keyfile string | success | Path for authorized key file. Sample: /home/user/.ssh/authorized_keys
manage_dir boolean | success | Whether this module managed the directory of the authorized key file. Sample: True
path string | success | Alternate path to the authorized_keys file
state string | success | Whether the given key (with the given key_options) should or should not be in the file Sample: present
unique boolean | success | Whether the key is unique
user string | success | The username on the remote host whose authorized_keys file will be modified Sample: user
validate_certs boolean | success | This only applies if using a https url as the source of the keys. If set to `no`, the SSL certificates will not be validated. Sample: True

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Core Team. [core]

### Red Hat Support

More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.

### Authors

- Ansible Core Team

Hint

If you notice any issues in this documentation, you can edit this document to improve it.