ssh

The ssh commands control SSH and SFTP access to an environment. For extra SFTP accounts with their own credentials, see sftp-users.

kinstactl ssh status my-site --env live
kinstactl ssh config my-site --env live
kinstactl ssh password get my-site --env live

Without --env, a site with one environment uses it; a site with several gets a picker on a terminal and fails with ENV_REQUIRED in a script. See Sites and environments. Commands that change something accept --dry-run, which prints the request and sends nothing. The --no-wait and --timeout flags of operations do not exist here.

ssh status

Show whether SSH and SFTP access is enabled.

kinstactl ssh status my-site --env live

kinstactl ssh status [site] [options]

Show whether SSH and SFTP access is enabled

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/ssh/get-status

The command prints enabled or disabled. With --json it prints site, environment and is_ssh_enabled.

ssh enable

Enable SSH and SFTP access of an environment.

kinstactl ssh enable my-site --env live

kinstactl ssh enable [site] [options]

Enable SSH and SFTP access of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/set-status

Enabling needs no confirmation. On success the command prints SSH enabled.

ssh disable

Disable SSH and SFTP access of an environment.

kinstactl ssh disable my-site --env live

kinstactl ssh disable [site] [options]

Disable SSH and SFTP access of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/set-status

Disabling asks for no confirmation either. On success the command prints SSH disabled.

ssh config

Show the SSH and SFTP connection details.

kinstactl ssh config my-site --env live

kinstactl ssh config [site] [options]

Show the SSH/SFTP connection details

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/{site_id}/environments/{env_id}/ssh/config

The command prints the host, port and user, followed by a ready-to-run command line of the form ssh <user>@<host> -p <port>. It does not print a ~/.ssh/config block, and no password. With --json you get host, port, user and ssh_command. If the environment has no connection details, the command fails with API_ERROR.

ssh allowlist

Show or change the IP allowlist for SSH and SFTP access.

kinstactl ssh allowlist my-site --env live

kinstactl ssh allowlist [site] [options]

Show or change the IP allowlist for SSH and SFTP access

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--add <ip...>`	IP addresses to add
`--remove <ip...>`	IP addresses to remove
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/ssh/get-allowed-ips, POST /sites/environments/{env_id}/ssh/set-allowed-ips

Without --add or --remove the command prints the current allowlist, one address per line. --add and --remove take one or more addresses and change the list:

kinstactl ssh allowlist my-site --env live --add 203.0.113.7
kinstactl ssh allowlist my-site --env live --remove 203.0.113.7 203.0.113.8

The command checks the change against the current list before sending it. It fails with a USAGE error if you add an address that is already present, repeat one in --add, give the same address to --add and --remove, or remove an address that is not in the list. There is no option to clear the whole list; remove the addresses one by one. Changes need no confirmation.

ssh password get

Print the SSH and SFTP password of an environment.

kinstactl ssh password get my-site --env live

kinstactl ssh password get [site] [options]

Print the SSH/SFTP password of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/ssh/password

The password is the only thing printed on stdout, so it can be captured in a script. With --json it is the field sftp_password. This is the only ssh command that prints a secret.

ssh password generate

Generate a new SSH and SFTP password.

kinstactl ssh password generate my-site --env live

kinstactl ssh password generate [site] [options]

Generate a new SSH/SFTP password

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/generate-password

The new password replaces the old one, and is not printed. The command prints a message that tells you to run ssh password get to read it.

ssh password enable

Enable SSH and SFTP password login.

kinstactl ssh password enable my-site --env live

kinstactl ssh password enable [site] [options]

Enable SSH/SFTP password login of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/set-password-status

On success the command prints SSH password login enabled.

ssh password disable

Disable SSH and SFTP password login.

kinstactl ssh password disable my-site --env live

kinstactl ssh password disable [site] [options]

Disable SSH/SFTP password login of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/set-password-status

On success the command prints SSH password login disabled. Neither this command nor ssh password enable asks for confirmation.

ssh password expiration

Set how long the SSH and SFTP password stays valid.

kinstactl ssh password expiration my-site 7d --env live

kinstactl ssh password expiration <site> <interval> [options]

Set how long the SSH/SFTP password stays valid

Arguments

Argument	Description
`site`	site name, display name or ID
`interval`	validity of the password Choices: `24h`, `7d`, `30d`, `90d`, `never`.

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/ssh/change-expiration-interval

The interval is a required argument after the site, and one of 24h, 7d, 30d, 90d or never. On success the command prints Password expiration set to <interval>.