Git - Connect to your repositories with SSH

Last updated on Oct 27, 2026

All STACKIT Git instances share one SSH address. The name of your instance is the first element of the repository path.

Address of a repository

ssh://git@ssh.git.onstackit.cloud/<instance>/<owner>/<repository>.git

<instance> is the name of your Git instance, which is also the first part of its web address. For the instance example.git.onstackit.cloud and the repository my-team/my-service, the address is:

ssh://git@ssh.git.onstackit.cloud/example/my-team/my-service.git

You also find the address of a repository behind the Clone button in the web interface of your instance.

Prepare your network and your client

Register your public SSH key in your user profile of the instance, under User settings > SSH / GPG keys. See Create your first Git service.
Allow outbound traffic to 213.17.16.145 on port 22, if your network restricts outbound connections.
Trust the host key of ssh.git.onstackit.cloud, if your systems verify host keys. The fingerprint is SHA256:I4jgl6ALgx5qOWwpQVC2M613dV7R0Wy6LfQQ5LQKwR4 (ED25519).

The IP allowlist of your instance applies to SSH as well. A client outside the allowed ranges is refused with a message that names the reason.

To add the host key to a system that runs without an interactive prompt, for example a build agent:

ssh-keyscan ssh.git.onstackit.cloud >> ~/.ssh/known_hosts

Compare the result with the fingerprint of step 3 before you use it:

ssh-keyscan ssh.git.onstackit.cloud | ssh-keygen -lf -

Clone a repository

git clone ssh://git@ssh.git.onstackit.cloud/<instance>/<owner>/<repository>.git

To check the connection without cloning:

git ls-remote ssh://git@ssh.git.onstackit.cloud/<instance>/<owner>/<repository>.git

Update a repository that uses the instance-specific address

Repositories cloned with the address git@ssh.<instance>.git.onstackit.cloud:<owner>/<repository>.git have to be pointed at the shared address. Run this command in each repository:

git remote set-url origin "$(git remote get-url origin | sed -E 's#^(ssh://)?git@ssh\.([^.]+)\.git\.onstackit\.cloud[:/]#ssh://git@ssh.git.onstackit.cloud/\2/#')"

Verify the result with git remote -v, and repeat it for every remote of the repository, not only for origin.

Update the setups that store the address

Your SSH configuration

An entry in ~/.ssh/config that names the instance-specific host no longer matches anything, because every instance shares one hostname. Replace it with an entry for ssh.git.onstackit.cloud:

Host ssh.git.onstackit.cloud
    User git
    IdentityFile ~/.ssh/<your key>
    IdentitiesOnly yes

More than one SSH key

Your client offers one SSH key, and that key has to be registered in the instance you connect to. IdentitiesOnly yes in the entry of Your SSH configuration is what makes your client offer the key you named instead of every key it knows.

If you work with a different key per instance, one entry is not enough, because the hostname no longer identifies the instance. Select the key in each repository instead:

git config core.sshCommand "ssh -i ~/.ssh/<your key> -o IdentitiesOnly=yes"

Build pipelines and automation

Wherever a pipeline, a job or a script holds the address of a repository, update it to the shared address. In addition, the agent that runs the job needs the three items of Prepare your network and your client: a registered key, outbound access to the address and the port, and the host key in its known_hosts file.

If a system rewrites addresses instead of storing them, keep the rewrite and change its target:

git config --global url."ssh://git@ssh.git.onstackit.cloud/<instance>/".insteadOf "ssh://git@ssh.<instance>.git.onstackit.cloud/"

Deployment tools and GitOps

Tools that connect to a repository with their own stored credentials, for example a deployment tool that synchronizes a cluster from a repository, hold both the address and a host key entry. Update the address, replace the host key entry, and register the key of the tool in your instance if it is not registered yet.

Infrastructure as code

A module source that points at a repository over SSH carries the address in its declaration, for example:

git::ssh://git@ssh.git.onstackit.cloud/<instance>/<owner>/<repository>.git//<module path>?ref=<tag>

Search your configuration for the instance-specific hostname to find every occurrence.

Repository mirrors

A mirror that pushes to or pulls from your STACKIT Git repository holds the address in the system that runs it. Update it there. Mirrors configured inside STACKIT Git that point at an external system are not affected.

Errors and what they mean

Access is denied for an instance

access denied for instance <instance>

Your client offered an SSH key that is not registered in that instance, or the address of your client is not in the IP allowlist of the instance. List your local keys with ssh-add -l, compare them with the keys under User settings > SSH / GPG keys of your instance, and select the registered key as described in More than one SSH key.

If the name in the message is the owner of your repository rather than your instance, the address carries no instance element, and the owner is read as the name of the instance. Use the address format of Address of a repository.

The hostname cannot be resolved

ssh: Could not resolve hostname ssh.<instance>.git.onstackit.cloud

The repository still uses the instance-specific address. Update the remote as described in Update a repository that uses the instance-specific address.

The public key is rejected

git@ssh.<instance>.git.onstackit.cloud: Permission denied (publickey)

The SSH key you offered is not registered in the instance, and the instance is still reachable under its own address. Register the key in your user profile, or select a registered key.

The host key cannot be verified

Host key verification failed

The host key of ssh.git.onstackit.cloud is missing from the known_hosts file of the system you run the command on. Add the host key as described in Prepare your network and your client.