Skip to main content
Configure SSH access to running Baseten workloads. Run baseten ssh setup once, then connect to any running workload with:
The environment form resolves the environment’s current deployment at connect time, so ssh production.model-<model-id>.ssh.baseten.co always lands on whatever is serving production. To reach a specific replica, append its 5-char replica ID to the deployment form: model-<model-id>-<deployment-id>-<replica>.ssh.baseten.co. SSH access requires the workload to be running with SSH enabled.

​
setup

One-time setup: generate an SSH keypair and add a managed block to ~/.ssh/config that routes *.ssh.baseten.co connections through this CLI. After running this once, connect to a running workload with:
The connection is authenticated with the profile selected at setup time (--profile or the current profile). Re-run to refresh the keypair and config block. Setup fails if ~/.ssh/config already configures these hosts outside the managed block (for example from truss ssh setup).

​
Options

​
TEXT
Filter JSON output with a jq expression; implies —output json (or jsonl for streamed commands)
​
TEXT
default:"text"
Output formatOne of: text, json, jsonl, none
​
TEXT
Use a specific stored profile for this command, overriding BASETEN_PROFILE and the current profile
​
BOOL
Enable verbose logging

​
Examples

Configure SSH access using the current profile
Configure SSH access pinned to a specific profile

​
Filter output with --jq

Print the generated keypair path

​
Output

Text mode (--output text): Prints the keypair path and pinned profile to stderr; no stdout output. JSON mode (--output json): payload type cmd.SSHSetupResult. On success, stdout is a JSON object with the keypair path, whether an existing key was reused, and the pinned profile.