> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baseten.co/llms.txt
> Use this file to discover all available pages before exploring further.

# baseten ssh

> Manage SSH access to Baseten workloads

Configure SSH access to running Baseten workloads.

Run `baseten ssh setup` once, then connect to any running workload with:

```sh theme={"system"}
ssh model-<model-id>-<deployment-id>.ssh.baseten.co
ssh <environment>.model-<model-id>.ssh.baseten.co
ssh training-job-<job-id>-<node>.ssh.baseten.co
```

The environment form resolves the environment's current deployment at connect time, so `ssh production.model-<model-id>.ssh.baseten.co` always lands on whatever is serving production. To reach a specific replica, append its 5-char replica ID to the deployment form: `model-<model-id>-<deployment-id>-<replica>.ssh.baseten.co`.

SSH access requires the workload to be running with SSH enabled.

## setup

```sh theme={"system"}
baseten ssh setup [OPTIONS]
```

One-time setup: generate an SSH keypair and add a managed block to `~/.ssh/config` that routes `*.ssh.baseten.co` connections through this CLI.

After running this once, connect to a running workload with:

```sh theme={"system"}
ssh model-<model-id>-<deployment-id>.ssh.baseten.co
ssh <environment>.model-<model-id>.ssh.baseten.co
ssh training-job-<job-id>-<node>.ssh.baseten.co
```

The connection is authenticated with the profile selected at setup time (`--profile` or the current profile). Re-run to refresh the keypair and config block. Setup fails if `~/.ssh/config` already configures these hosts outside the managed block (for example from `truss ssh setup`).

### Options

{/* Do not hand-edit. Update OVERRIDES / NOTES / HIDDEN_FLAGS in the generator. */}

<ParamField body="-q, --jq" type="TEXT">
  Filter JSON output with a jq expression; implies --output json (or jsonl for streamed commands)
</ParamField>

<ParamField body="-o, --output" type="TEXT" default="text">
  Output format

  One of: `text`, `json`, `jsonl`, `none`
</ParamField>

<ParamField body="--profile" type="TEXT">
  Use a specific stored profile for this command, overriding BASETEN\_PROFILE and the current profile
</ParamField>

<ParamField body="-v, --verbose" type="BOOL">
  Enable verbose logging
</ParamField>

### Examples

Configure SSH access using the current profile

```sh theme={"system"}
baseten ssh setup
```

Configure SSH access pinned to a specific profile

```sh theme={"system"}
baseten ssh setup --profile prod
```

### Filter output with `--jq`

Print the generated keypair path

```sh theme={"system"}
baseten ssh setup --jq '.key_path'
```

### Output

**Text mode (`--output text`):** Prints the keypair path and pinned profile to stderr; no stdout output.

**JSON mode (`--output json`):** payload type `cmd.SSHSetupResult`.

On success, stdout is a JSON object with the keypair path, whether an existing key was reused, and the pinned profile.

## sign

```sh theme={"system"}
baseten ssh sign [OPTIONS] <hostname>
```

Internal command invoked by the SSH config `Match exec` step. Signs a short-lived certificate for the workload named by the hostname, writes it next to the keypair, and caches the proxy authorization for the proxy step.

### Options

{/* Do not hand-edit. Update OVERRIDES / NOTES / HIDDEN_FLAGS in the generator. */}

<ParamField body="--default-profile" type="TEXT">
  Profile to use when none is selected via --profile or BASETEN\_PROFILE. Baked into the SSH config by setup.
</ParamField>

<ParamField body="-q, --jq" type="TEXT">
  Filter JSON output with a jq expression; implies --output json (or jsonl for streamed commands)
</ParamField>

<ParamField body="-o, --output" type="TEXT" default="text">
  Output format

  One of: `text`, `json`, `jsonl`, `none`
</ParamField>

<ParamField body="--profile" type="TEXT">
  Use a specific stored profile for this command, overriding BASETEN\_PROFILE and the current profile
</ParamField>

<ParamField body="-v, --verbose" type="BOOL">
  Enable verbose logging
</ParamField>

### Examples

Sign a certificate for a model deployment (run by ssh, not directly)

```sh theme={"system"}
baseten ssh sign model-<model-id>-<deployment-id>.ssh.baseten.co
```

### Output

**Text mode (`--output text`):** No output on success; the signed certificate and proxy authorization are written to disk.

**JSON mode (`--output json`):** payload type `cmd.JSONUndefined`.

Emits an empty JSON object on success; the certificate and proxy authorization are written to disk, not stdout.

## proxy

```sh theme={"system"}
baseten ssh proxy [OPTIONS] <hostname>
```

Internal command used as the SSH config `ProxyCommand`. Connects to the SSH proxy using the authorization cached by the sign step and relays the connection between stdin and stdout.

### Options

{/* Do not hand-edit. Update OVERRIDES / NOTES / HIDDEN_FLAGS in the generator. */}

<ParamField body="--default-profile" type="TEXT">
  Profile to use when none is selected via --profile or BASETEN\_PROFILE. Baked into the SSH config by setup.
</ParamField>

<ParamField body="-q, --jq" type="TEXT">
  Filter JSON output with a jq expression; implies --output json (or jsonl for streamed commands)
</ParamField>

<ParamField body="-o, --output" type="TEXT" default="text">
  Output format

  One of: `text`, `json`, `jsonl`, `none`
</ParamField>

<ParamField body="--profile" type="TEXT">
  Use a specific stored profile for this command, overriding BASETEN\_PROFILE and the current profile
</ParamField>

<ParamField body="-v, --verbose" type="BOOL">
  Enable verbose logging
</ParamField>

### Examples

Relay a connection (run by ssh as ProxyCommand, not directly)

```sh theme={"system"}
baseten ssh proxy model-<model-id>-<deployment-id>.ssh.baseten.co
```

### Output

**Text mode (`--output text`):** Relays raw bytes between stdin/stdout and the SSH proxy; produces no other output.

**JSON mode (`--output json`):** payload type `cmd.JSONUndefined`.