> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baseten.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Signs an SSH certificate for an inference model

> Signs a short-lived SSH certificate granting access to a running inference model pod. Returns the signed SSH certificate, a JWT token for SSH proxy authentication, the proxy address to connect through, and the certificate expiry time.



## OpenAPI

````yaml post /v1/models/{model_id}/deployments/{deployment_id}/ssh/sign
openapi: 3.1.0
info:
  description: REST API for management of Baseten resources
  title: Baseten management API
  version: 1.0.0
servers:
  - url: https://api.baseten.co
security:
  - BearerAuth: []
paths:
  /v1/models/{model_id}/deployments/{deployment_id}/ssh/sign:
    parameters:
      - $ref: '#/components/parameters/model_id'
      - $ref: '#/components/parameters/deployment_id'
    post:
      summary: Signs an SSH certificate for an inference model
      description: >-
        Signs a short-lived SSH certificate granting access to a running
        inference model pod. Returns the signed SSH certificate, a JWT token for
        SSH proxy authentication, the proxy address to connect through, and the
        certificate expiry time.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignSSHCertificateRequestV1'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignSSHCertificateResponseV1'
      x-codeSamples:
        - lang: bash
          source: >-
            curl --request POST \

            --url
            https://api.baseten.co/v1/models/{model_id}/deployments/{deployment_id}/ssh/sign
            \

            --header "Authorization: Bearer $BASETEN_API_KEY" \

            --data '{
              "public_key": null,
              "replica_id": null
            }'
        - lang: python
          source: >-
            import requests

            import os

            API_KEY = os.environ.get("BASETEN_API_KEY", "<YOUR_API_KEY>")

            url =
            "https://api.baseten.co/v1/models/{model_id}/deployments/{deployment_id}/ssh/sign"


            headers = {"Authorization": f"Bearer {API_KEY}"}


            response = requests.request(
                "POST",
                url,
                headers=headers,
                json={'public_key': None, 'replica_id': None}
            )


            print(response.text)
components:
  parameters:
    model_id:
      schema:
        type: string
      name: model_id
      in: path
      required: true
    deployment_id:
      schema:
        type: string
      name: deployment_id
      in: path
      required: true
  schemas:
    SignSSHCertificateRequestV1:
      description: Request to sign an SSH certificate for accessing a workload pod.
      properties:
        public_key:
          description: The user's SSH public key (e.g., 'ssh-ed25519 AAAA... user@host').
          title: Public Key
          type: string
        replica_id:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          description: >-
            The replica to connect to. Required for training jobs (e.g. '0').
            Optional for inference (server picks a running replica if omitted).
          title: Replica Id
      required:
        - public_key
      title: SignSSHCertificateRequestV1
      type: object
    SignSSHCertificateResponseV1:
      description: Response containing a signed SSH certificate for proxy authentication.
      properties:
        ssh_certificate:
          description: The signed SSH certificate in OpenSSH format.
          title: Ssh Certificate
          type: string
        jwt:
          description: Signed JWT (ES256) for SSH proxy authorization.
          title: Jwt
          type: string
        proxy_address:
          description: Address of the SSH proxy to connect to (host:port).
          title: Proxy Address
          type: string
        ssh_cert_expires_at:
          description: When the certificate expires, in ISO 8601 format.
          format: date-time
          title: Ssh Cert Expires At
          type: string
      required:
        - ssh_certificate
        - jwt
        - proxy_address
        - ssh_cert_expires_at
      title: SignSSHCertificateResponseV1
      type: object
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: >-
        Send `Authorization: Bearer <api_key>`. The legacy `Authorization:
        Api-Key <api_key>` scheme is also accepted.

````