Fydra SSH Agent for Mac
Version 1.2 · Requires Fydra Pro 1.2 and macOS 14 (Sonoma) or later · Apple Silicon & Intel
The Fydra SSH Agent lets SSH clients (Terminal, Git, your IDE) use SSH keys stored in Fydra without exporting the private key to a file. When a key is needed to sign, the agent asks for Touch ID and hands back only the signature.
Why a separate download? The main Fydra app ships on the Mac App Store (sandboxed). The SSH agent needs to integrate with your shell and SSH clients, so it's distributed as a separate, Apple-notarized download. Both are signed by the same developer. The app hands your SSH keys to the agent encrypted, so only the agent can read them.
Setup
- Open the downloaded
.dmgand drag Fydra SSH Agent into/Applications, then launch it. - Click the 🔑 menu-bar icon → Start at Login and approve it in System Settings → General → Login Items.
- Add this line to your shell profile (
~/.zshrcor~/.bashrc):
export SSH_AUTH_SOCK="$HOME/Library/Group Containers/group.com.fydra.vault/ssh-agent.sock"- Restart your terminal, then create or import SSH keys in Fydra.
- Verify with
ssh-add -l— your Fydra keys should appear. - Use Git and SSH normally. The first time an app uses a key, you approve it with Touch ID.
Touch ID approvals
By default, one approval covers each app (for example iTerm or VS Code)
until your Mac or Fydra locks, or your Mac sleeps. This keeps shell prompts
that run git fetch in the background from asking over and
over. In Fydra → Settings → Developer you can limit an
approval to one terminal session or to one hour, or choose
Always ask to approve every signature.
Passphrase-protected keys
The agent can only use keys without a passphrase. When a key has one,
Fydra shows a Copy Terminal Command button: paste the
command into Terminal, enter the passphrase, and paste the result back
into Fydra. The command uses macOS's own ssh-keygen on a
temporary copy, so your original key file isn't changed. From then on
the key is protected by your Fydra vault encryption and Touch ID instead
of its own passphrase. Fydra never sees or stores the passphrase.
Updating from version 1.0
Version 1.2 of the agent and Fydra 1.2 for Mac work only with each other. Update both, then open Fydra once so it hands your keys to the new agent. Version 1.2 also deletes the unencrypted key copy that agent 1.0 kept on disk.
Security
- SSH clients only receive signatures, never your private keys.
- Encrypted handoff: the app encrypts your SSH keys for the agent, whose own key stays in your login Keychain. No private key is written to disk unencrypted.
- Touch ID approval, remembered as you choose in Settings.
- Supports Ed25519 keys, and RSA keys in PEM (PKCS#1) format.
- Notarized by Apple and runs with the Hardened Runtime.