Managing Personal & Company GitHub SSH Keys

When working on a personal laptop, you often need to manage two distinct identities: your personal GitHub account and your corporate identity under the your organization.

By default, Git and SSH will blindly use your default key, which can result in Repository not found errors or commits accidentally signed with your personal email. This guide configures your machine to automatically route network traffic and commit authorship based on the folder you are working in.

Step 1: Generate a dedicated SSH key for your company username

First, we need to create a brand-new cryptographic key pair that will belong exclusively to your company identity. Run the following command in your terminal:

ssh-keygen -t ed25519 -C "name.surname@my-company.com" -f ~/.ssh/id_ed25519_my-company
  • -t ed25519: Uses the Ed25519 encryption algorithm.
  • -C "...": Attaches your work email as a visible comment label inside the key so you can easily identify it later.
  • -f ~/.ssh/id_ed25519_my-company: Explicitly names the file so it does not overwrite your existing personal key (id_ed25519).

⚠️ Crucial Next Step: Copy your new public key (cat ~/.ssh/id_ed25519_my-company.pub), log into your corporate GitHub account, navigate to Settings -> SSH and GPG keys, and add it. If your company enforces SAML Single Sign-On, make sure to click Configure SSO next to the key after saving it to authorize the organization.

Step 2: Configure Your SSH Routing Rules

Now we need to tell your computer when to present this new key. Open your SSH configuration file:

nano ~/.ssh/config

Paste the following configuration blocks. This creates a custom network nickname (github-my-company) specifically for your company traffic:

Host github.com
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Host github-my-company
  HostName github.com
  User git
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519_my-company

What these properties mean:

  • Host github-my-company: The custom shorthand nickname you will use for work traffic.
  • HostName github.com: Tells SSH that whenever you use the github-my-company nickname, it should actually connect to the real github.com servers.
  • User git: Automates the SSH username requirement (every GitHub connection uses git).
  • IdentityFile: Directs SSH to isolate your personal keys stay with standard traffic, and id_ed25519_my-company handles work traffic.
  • AddKeysToAgent & UseKeychain: A macOS optimization. This securely saves your passphrases into the system Keychain so you never have to re-type them after a reboot.

Step 3: Refresh your SSH Agent Memory

Sometimes background terminal processes cache older sessions. To force your terminal to recognize the changes immediately, wipe the cache and reload both keys:

ssh-add -D && ssh-add ~/.ssh/id_ed25519 && ssh-add ~/.ssh/id_ed25519_my-company
  • ssh-add -D: Deletes all currently cached identities from your terminal’s active memory.
  • &&: Chains the commands safely, running the next step only if the previous one succeeds.
  • ssh-add [path]: Explicitly loads your clean personal and work keys back into memory.

Step 4: Verify the Connection

Before configuring Git, let’s test if GitHub successfully recognizes who you are based on the incoming keys. Run these test connections:

ssh -T git@github.com; ssh -T git@github-my-company

What you should see:

  • The first command should welcome you by your Personal GitHub username.
  • The second command should welcome you by your Work GitHub username.

Hi username! You've successfully authenticated, but GitHub does not provide shell access.

Step 5: Create a Separate Git Profile for your company

To prevent accidentally committing to company repositories using your personal name or email address, we need an isolated configuration file.

Create a new file in your user home directory:

nano ~/.gitconfig-my-company

Add your corporate authorship details and an automatic URL-rewriting rule:

[user]
    email = name.surname@my-company.com

[url "git@github-my-company:"]
    insteadOf = git@github.com:
  • [user]: Ensures any commit made under this profile uses your professional email.
  • [url ...].insteadOf: This is where the magic happens. It automatically intercepts any standard GitHub link you copy from the browser (git@github.com:...) and silently rewrites it to use your custom github-my-company routing rule on the fly. You will never have to manually edit a URL when cloning.

Finally, we tell Git to dynamically load that work profile, but only when you are working inside your dedicated company folder.

Open your main global Git configuration file:

nano ~/.gitconfig

Append this conditional inclusion block to the very bottom of the file:

[includeIf "gitdir:~/my-company-repos/"]
    path = ~/.gitconfig-my-company

  • gitdir:~/my-company-repos/: This monitors your active directory path. As long as a repository sits inside the ~/my-company-repos/ folder on your computer, this condition is met.

  • path: Dynamically injects your corporate email and URL rewriting rules into your Git environment when the folder condition matches.

You’re all set!

From this point forward, your workflow is completely automated:

  1. Create the folder ~/my-company-repos (if you haven’t already).
  2. Open your browser, go to a repository of your company, click the Code button, and copy the standard SSH URL exactly as it is.
  3. Open your terminal, change directories into your work folder, and clone it normally:
cd ~/my-company-repos/
git clone git@github.com:Your-Organization/project-name.git

Git will automatically catch the path, apply your work email, and route the connection securely through your company-bound SSH key without a single manual edit required.