# SSH and Shell Access

You can initiate a shell session to your Render service from its *Shell* page in the [Render Dashboard][dboard]:

[img]

If your service is [scaled](scaling) to multiple instances, you can connect to a specific instance using the *Instance* dropdown.

You can also SSH into your services from the terminal after [completing setup](#ssh-setup).

## Compatible service types

Support for shell access varies by service type:

| Service type | Dashboard shell | SSH |
|--------|--------|--------|
| *Paid [web service](web-services)* | 🟢 | 🟢 |
| *[Private service](private-services)* | 🟢 | 🟢 |
| *[Background worker](background-workers)* | 🟢 | 🟢 |
| *[Cron job](cronjobs)* | 🟨 [See details.](#cron-job-connections) | ❌ |
| *[Free](free) web service* | ❌ | ❌ |
| *Other service types (static sites, datastores)* | ❌ | ❌ |

## SSH setup

### 1. Generate an SSH key pair

> *Skip this step if you already have an SSH key on your machine that you want to use.*

1. Run the following command to generate an Ed25519 key pair in the `~/.ssh` directory:

   ```shell
   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
   ```

   You can optionally use a different [key type](#supported-key-types).

2. The command prompts you to provide an optional passphrase for your private key (recommended for added security).

3. The command generates two files in your `~/.ssh` directory:

   - `~/.ssh/id_ed25519` (private key)
   - `~/.ssh/id_ed25519.pub` (public key)

> **Your private key is a secret credential. Don't share it with anyone.**
>
> To enable SSH access, you'll share the _public_ key with Render.

### 2. Add your public key to your Render account

1. Open your [Account settings page](http://dashboard.render.com/settings#ssh-public-keys) in the Render Dashboard.
2. Find the **SSH Public Keys** section and click **+ Add SSH Public Key**. The creation dialog appears.
3. Provide a descriptive **Name** for the key (e.g., "Personal Laptop").
4. Copy the full contents of your _public_ key file (ends in `.pub`) to your clipboard.

   On macOS, you can use the `pbcopy` command to copy the file to your clipboard:

   ```shell
   pbcopy < ~/.ssh/id_ed25519.pub
   ```

5. Paste your public key into the **Key** field:

   [img]

6. Click **Add SSH Public Key** button to save your key.

All set! You're ready to [start an SSH session](#starting-an-ssh-session).

## Starting an SSH session

After completing [SSH setup](#ssh-setup), you can start SSH sessions from your terminal using the [Render CLI](cli), or by running the `ssh` command directly.

Select a method from the tabs below:

**Render CLI**

1. [Install and log in to the Render CLI](cli#setup) if you haven't already.
2. Run the following command:

   ```shell
   render ssh
   ```

   This opens an interactive menu that lists your workspace's SSH-compatible services.

3. Use the arrow keys to select a service and press **Enter**. The interactive menu closes and the SSH session starts.

To skip menu-based selection, you can include your service's ID directly in the `render ssh` command:

```shell
render ssh srv-abc123
```

**SSH command**

1. In the [Render Dashboard][dboard], open the settings for the service you want to connect to.

2. Click the **Connect** dropdown in the upper right and select the **SSH** tab:

   [img]

> **Don't see the SSH tab?** The selected service is not SSH-compatible. See [Compatible service types](#compatible-service-types).

3. Copy the SSH command to your clipboard.

4. Paste the SSH command into your terminal and run it.

   ```shell
   ssh YOUR_SERVICE@ssh.YOUR_REGION.render.com
   ```

5. You might see a warning like this:

   ```
   The authenticity of host 'render.com (IP_ADDRESS)' can't be established.
   ED25519 key fingerprint is (SSH_KEY_FINGERPRINT)
   Are you sure you want to continue connecting (yes/no)?
   ```

   If you do, confirm that the fingerprint in the message matches Render’s
   [public key fingerprint](#renders-public-key-fingerprints) for your region. If it does, type `yes` to continue.

6. If you receive a "permission denied" message, see [Troubleshooting permission failures](#troubleshooting-permission-failures).

### Connecting to a specific instance

By default, SSH sessions connect to a random running instance of your service. To connect to a _specific_ instance, include that instance's 5-character slug in the hostname of your SSH command:

```shell{outputLines:1,3-4}