Credentials

Korta uses only the credentials it needs, and it never stores your private keys in offline mode. The core CLI needs SSH access to your hosts. Korta Enterprise also uses a manager token for the CLI and web console, and cloud credentials to create AWS and Google Cloud instances.

SSH access to hosts

The core CLI connects with OpenSSH, using your own setup. Each host needs a key it accepts, and either passwordless sudo or a root login.

Create a key for Korta and install its public half on a host:

ssh-keygen -t ed25519 -f ~/.ssh/korta_ed25519 -C korta
ssh-copy-id -i ~/.ssh/korta_ed25519.pub ubuntu@10.0.0.5
ssh -i ~/.ssh/korta_ed25519 ubuntu@10.0.0.5 'sudo -n true && echo ready'

The last command must print ready without asking for a password. Connecting once also records the host's key in ~/.ssh/known_hosts. Korta refuses hosts whose key is missing or has changed.

Name the key in your inventory. An identity: line applies to a whole group, and identity= applies to one host:

# Production
identity: ~/.ssh/korta_ed25519
user: ubuntu
- db1 10.0.0.5

# Staging
identity: ${STAGING_SSH_KEY}
user: deploy
- web1 10.1.0.5

Korta checks every key file before connecting. Key files need mode 600 (chmod 600 ~/.ssh/korta_ed25519). A key with a passphrase must be loaded first with ssh-add ~/.ssh/korta_ed25519, because SSH runs in batch mode and never prompts.

Setting	Flag	Environment	Use
Private key for every host	--identity FILE, -k	KORTA_IDENTITY	Override the inventory, for example in CI
SSH config	--ssh-config FILE	KORTA_SSH_CONFIG	Replace ~/.ssh/config, for example with a committed known_hosts
Inventory	-i FILE	KORTA_INVENTORY	Choose the host list

The full order of precedence and CI example are in the CLI reference.

Manager sign-in (Korta Enterprise)

The CLI and web console sign in to a manager with a token. Save a personal token from the Account page, or the administrator token for first-time setup:

korta login --server https://korta.example.com --token-file ~/.korta-token

Korta saves the token in your user configuration directory with mode 600, and sends it only to the manager it was saved for. Use https:// for any manager on another machine; see Sign in.

AWS credentials (Korta Enterprise)

The core CLI doesn't use AWS credentials. AWS instance roles run on the manager, which signs in to each AWS account listed under Settings > AWS > Accounts. Each account uses one of three methods:

• Assume a role (recommended): the manager's identity assumes an IAM role in the account, and Korta gets short-lived credentials for each run.
• Access key: the access key ID, with the secret stored sealed in the vault and never shown again.
• Manager's environment: the manager's own IAM role or AWS variables.

Roles never contain credentials. The IAM policies, regions and the default account are in AWS provisioning.

Google Cloud credentials (Korta Enterprise)

GCP instance roles run on the manager too. Under Settings > Google Cloud, choose the manager's environment (Application Default Credentials, such as an attached service account) or upload a service-account key, which the vault encrypts. The full steps are in Google Cloud credentials.

Where your secrets live

Credential	Core CLI	Korta Enterprise
SSH private keys	Stay on your machine, in ~/.ssh or your agent	Uploaded to the manager's vault
Manager token	Not used	Saved on your machine with mode 600
AWS and Google Cloud	Not used	Set up on the manager; keys sealed in the vault
Named secrets	Not used	Stored in the vault, never shown in plans or logs