SSH key manager that stays on disk

Keys trapped in an app are keys you fight later

GUI clients often manage identities inside their own world. Exporting, rotating, or reusing those keys with OpenSSH becomes a conversion chore.

The other extreme is a pile of unnamed files in ~/.ssh with no sense of which host uses which identity.

Native keys, clearer workflow

Bast generates, imports, exports, and installs standard OpenSSH keys. Passphrases stay local. Files live under predictable paths such as ~/.ssh/bast/keys/.

When you attach an identity to a host, that choice is still expressed in SSH config terms other tools can read.

Create and use a key

1. Run bast keys generate work or use the Keys tab in the TUI.
2. Install the public key on a host with bast keys install work --host <host>, or point the host at the identity file in config.
3. Use Keys and Key selector docs when you need import/export details.

Optional encrypted sync

If you need the same Bast-managed keys on another machine, Vault can sync that state end-to-end encrypted. Day-to-day SSH still speaks normal key files.