Delete a GitHub SSH Key Safely with gh ssh-key delete

Delete the wrong ID with gh ssh-key delete and you have locked out a laptop, a server or a CI job, not tidied your account. You will finish with a controlled way to remove one SSH key from your GitHub account, using its numeric ID and checking the result afterwards. The deletion is account-wide, not repository-specific.

Allow about ten minutes, including verification. You need GitHub CLI installed, an authenticated gh session for the account that owns the key, and permission to manage that account's SSH keys. The examples use GitHub CLI 2.87.3, installed here in the gh package. Your version may present slightly different diagnostics, so check its help before relying on automation.

1. Check the installed command

Start with a read-only help query. This is an ordinary user command and needs no elevated privileges:

$ gh --version
gh version 2.87.3 (2026-02-23)
$ gh ssh-key delete --help
Delete an SSH key from your GitHub account

USAGE
  gh ssh-key delete <id> [flags]

FLAGS
  -y, --yes   Skip the confirmation prompt

The subcommand accepts an ID and one option, --yes (or -y) to skip its confirmation prompt. There is no filename, public-key text, title or repository flag here: never paste a fingerprint or the contents of a .pub file where an ID is required.

2. Confirm the account and list its keys

Before choosing an ID, confirm which account and host your current credentials address:

$ gh auth status

Read the account name and hostname in the result. If they are wrong, do not continue: switch or authenticate the intended account first. A deletion succeeds against the account selected by your gh authentication, not necessarily the account you had in mind.

Now list the account's registered SSH keys:

$ gh ssh-key list
TITLE                 TYPE            ID
work-laptop           authentication  123456789
old-desktop           authentication  234567890

The displayed columns are host-specific. Match the exact title and type, then copy only the numeric value in the ID column. A title is not a stable command argument, and a key fingerprint is not the ID gh ssh-key delete expects.

If the list is empty, there is nothing to delete in that account. If a key you expect is missing, resolve the account, hostname and authentication problem before trying a different command.

3. Inspect the deletion before accepting it

Use the ID you just checked, without --yes, so the command can ask for confirmation:

$ gh ssh-key delete 234567890
? Are you sure you want to delete this SSH key? Yes

The exact prompt wording can vary by CLI release. Read it carefully. If the ID or account is not the one you intended, answer No or press Ctrl-C; a declined prompt leaves the key in place.

4. Delete the confirmed ID

After checking the prompt, confirm the deletion. This is still an ordinary user command, but it changes remote account state and should not be run casually from a script:

$ gh ssh-key delete 234567890
? Are you sure you want to delete this SSH key? Yes
$ printf 'exit status: %s\n' "$?"
exit status: 0

A zero status means the command completed successfully. It does not mean every other key was checked, nor does it revoke an SSH private key file stored on a computer: anyone holding a copy of that private key still possesses the credential, but GitHub will no longer accept it for the deleted account key.

For a deliberate non-interactive operation, add --yes only after the ID has been obtained and checked by a trustworthy process:

$ key_id='234567890'
$ gh ssh-key delete "$key_id" --yes
$ printf 'exit status: %s\n' "$?"
exit status: 0

Do not build this value from an unreviewed title match or arbitrary user input. A mistaken ID can remove a different key, and --yes removes the last human checkpoint.

5. Verify that the key is gone

List the keys again and check that the deleted ID no longer appears:

$ gh ssh-key list
TITLE                 TYPE            ID
work-laptop           authentication  123456789

For a script or a change record, capture the list and search for the exact ID rather than relying on the table's order:

$ gh ssh-key list | awk '$NF == "234567890" { found=1 } END { exit found }'
$ printf 'verification status: %s\n' "$?"
verification status: 0

The command above exits zero when the ID is still present, so it is a useful presence test but a poor success message on its own. To make absence explicit in a shell check:

if gh ssh-key list | awk '$NF == "234567890" { found=1 } END { exit found }'; then
    printf '%s\n' 'key is absent'
else
    printf '%s\n' 'key is still listed, or the list command failed' >&2
    exit 1
fi

In a real script, distinguish a failed list request from an empty match rather than treating every non-zero status as proof of deletion.

6. Handle the common boundary cases

This command deletes an SSH key associated with the authenticated GitHub account. It does not remove a local private key, edit ~/.ssh/config, delete a repository deploy key, or alter an organisation's policy: a repository deploy key needs the repository deploy-key commands instead.

Watch the TYPE column. Current GitHub CLI releases can display authentication and signing keys together, while this delete command takes only an ID and offers no type selector. If a signing-key ID returns an HTTP 404, do not retry with another ID at random: confirm the installed CLI's current behaviour and use GitHub's account settings or an appropriate API operation for that key type.

Do not use sudo for this operation. Elevated local privileges do not grant GitHub account permission and may select different local credentials or configuration. Fix authentication with gh auth status and gh auth login instead.