---
title: "How to Share SSH Credentials With a Link That Expires"
url: https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely
description: "Prefer the recipient's public key. When a private key or password must move, send it as a one-time link that expires and send the host and username separately."
lang: en
---

Security (https://uselinkpilot.com/blog/category/security)

# How to share SSH credentials with a link that expires securely

Prefer the recipient's public key. When a private key or password must move, send it as a one-time link that expires and send the host and username separately.

LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 25, 2026 · About LinkPilot (https://uselinkpilot.com/about)

Someone needs to get onto a server tonight, and the credential has to reach them now. The temptation is to paste the private key or the root password into Slack. Every message that key passes through keeps a copy, which is why the better route is a one-time link (https://uselinkpilot.com/glossary#one-time-link) that expires: the secret is retrieved once and then it is gone.

A link is only the delivery step, though. Before you create one, pick the right credential to send, scope it to the task and decide how you will remove it. This guide covers all of that, and includes the question of what to put in a one-time link for sharing server access details and what to leave out.

## Which SSH credential are you actually sharing?

SSH access can rest on four different things, and they have very different sharing rules.

| Credential | What it is | Should it ever move? | | --- | --- | --- | | Public key | The half the server stores | Yes, freely. It is not secret. | | Private key | The half the user holds | Only when generated for the recipient, and only once | | Password | A shared string checked by the server | Once, as a temporary value you will change | | SSH certificate | A key signed by your CA with a validity period | The certificate is not secret, the key behind it is |

**The best handoff is one where nothing secret moves.** If the recipient already has an SSH key pair, ask for their public key, add it to `~/.ssh/authorized_keys` on the right account, and tell them to connect. Removing that one line later ends their access.

**Generate a dedicated key for them** when they do not have one and cannot make one. Never send your own everyday private key. A key made for the recipient can be scoped, logged and deleted without touching anything else.

**Prefer certificates or managed access for recurring needs.** If the same person will need access repeatedly, repeated one-time handoffs are the wrong tool. An SSH certificate with a short validity, or an access tool such as Teleport or Tailscale SSH, gives you expiry built into the credential rather than bolted onto the delivery.

## Scope the credential before you share it

Whatever you send, make it as small as the task allows:

- **One account, one host.** Add the key to the service account that owns the work, not to root, and only on the machine involved.
- **Restrict what the key can do** with `authorized_keys` options such as `from="203.0.113.5"`, `no-port-forwarding` or a `command=` wrapper where the job is a single script.
- **Give the password a shelf life.** If you are sharing a password, set `passwd -e` or the platform's equivalent so the recipient has to change it on first login, and plan to disable the account at a set date.
- **Write the end date down** before you send anything. "When the work is done" is not a date.

## How to share SSH credentials with a link that expires

1. **Confirm the recipient** through a channel you already trust: the ticket, a known email thread, or a call. Most misdirected credentials are the result of a lookalike address or an autofilled name.
2. **Paste only the secret** into the one-time secret link tool (https://uselinkpilot.com/tools/free-secret-link-generator). For a private key that means the whole PEM block and nothing else. With LinkPilot the text is encrypted in your browser before it is stored, so the service only ever holds ciphertext, and the key to decrypt it sits in the part of the URL that browsers do not send to servers.
3. **Set the expiry to match the window.** One hour if they are waiting for it, 24 hours if they are in another time zone, seven days only when there is a real reason. The link is also destroyed the first time it is opened, so expiry is the backstop, not the main control.
4. **Add a passphrase on a Pro account** when the credential is sensitive, and pass the passphrase on by a different channel. An audit timeline on Pro also shows you when the reveal happened.
5. **Send the link with a one-line purpose note** and no connection details.
6. **Send the connection details in a separate message**: host or address, port, username, and the authentication method. None of those is secret alone, but together with the key they are the whole login.

If the link reports that it has already been opened and the recipient says they did not open it, do not debate it. Treat the credential as exposed, remove the key or change the password, and generate a new one.

## A one-time link for sharing server access details

The question of what belongs inside the secret comes up every time. A good rule is that the link carries the thing an attacker could not guess, and the plain message carries the things they could.

**In the one-time link:**

- The private key, or the temporary password
- A passphrase for the key if one was set at generation time
- Nothing else

**In a normal message, sent separately:**

- Hostname or IP address (https://uselinkpilot.com/glossary#ip-address) and port
- The account to log in as
- Whether to use a key or a password
- The host key fingerprint, so the recipient can verify the server on first connection
- A short note on what the access is for and when it ends

Keep screenshots and terminal logs out of both. A screenshot of a working session often includes tokens, internal addresses and other usernames that were never meant to travel.

## Help the recipient land the key safely

A secure handoff still fails if the key ends up in Downloads with world-readable permissions. Send these instructions along with the connection details:

```bash
# save the key, then lock it down
chmod 600 ~/.ssh/acme_deploy
ssh-add ~/.ssh/acme_deploy
# verify the host key fingerprint against the one you were sent
ssh -i ~/.ssh/acme_deploy deploy@203.0.113.5
```

Ask them to open the secret link (https://uselinkpilot.com/glossary#secret-link) only when they are ready to use it, on a device they control and over a connection they trust. Opening it on a shared machine "to check it works" leaves a copy in that machine's clipboard history.

## Verify, then close the window

While the access window is still open, have the recipient test the exact connection and confirm the task runs. Do not widen the permissions to make a test pass; fix the scope instead.

When the work is finished:

1. **Remove the public key** from `authorized_keys`, or disable the account, or let the certificate expire on schedule.
2. **Rotate anything that travelled** alongside the credential, including a temporary password that was meant to be changed on first login and was not.
3. **Review `auth.log`** or your SSH audit source for connections outside the agreed time or from unexpected addresses.
4. **Write down who had what, from when to when.** The record stays; the credential does not.

Expiry on the link limits how long the secret could be retrieved. Expiry on the credential limits how long it can be used. You want both, and the second one is the one people forget.

## Related reading

- Secure link sharing for developers: https://uselinkpilot.com/blog/secure-link-sharing-for-developers
- How to share API keys securely: https://uselinkpilot.com/blog/how-to-share-api-keys-securely
- Expiring links: the secret is destroyed, not just redirected: https://uselinkpilot.com/blog/expiring-links-security
- Link scanners and one-time secrets: https://uselinkpilot.com/blog/link-scanners-and-one-time-secrets

## Tools for this article

One-Time Secret Link Generator

Share a password or note through a link that opens once.
https://uselinkpilot.com/tools/free-secret-link-generator

Expiring Link Generator

Create links that stop working at a set time.
https://uselinkpilot.com/tools/temporary-link

Self-Destructing Message

Send a note that disappears after one read.
https://uselinkpilot.com/tools/burn-after-read-secret

## Frequently asked questions

### Does an expiring link make the SSH key expire?

### Is it safe to share a private SSH key through a one-time link?

### What should I share if the recipient already has an SSH key?

### Can a link expire before the recipient opens it?

### Can a security scanner or link preview use up a one-time link?

### Should the username and host go in the same message as the link?

## LinkPilot sends a secret link that is gone after it is opened.

Encrypted in your browser, revealed once, then destroyed. No account needed.

Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator)

## Read next

Security

### How to Share Credentials Securely Without Email

Four ways to share a password without email, when each one fits, and a step-by-step for a temporary link for sharing login details that burns after one open.
https://uselinkpilot.com/blog/how-to-share-credentials-securely-without-email

Security

### How to Send a Webhook Signing Secret to a Client Securely

Hand a webhook signing secret to a client without leaving copies in email or tickets: verify the recipient, send a one-time link, store it right, rotate if exposed.
https://uselinkpilot.com/blog/how-to-send-a-webhook-signing-secret-to-a-client-securely

Security

### How to Send a Temporary Database Login to a Contractor Securely

Create a scoped database user with an expiry, send the password as a one-time link instead of an email, lock down the connection and close the account on time.
https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Blog",
        "item": "https://uselinkpilot.com/blog"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "How to Share SSH Credentials With a Link That Expires (Securely)",
        "item": "https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BlogPosting",
    "@id": "https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely#article",
    "headline": "How to Share SSH Credentials With a Link That Expires (Securely)",
    "description": "Prefer the recipient's public key. When a private key or password must move, send it as a one-time link that expires and send the host and username separately.",
    "datePublished": "2026-10-25",
    "dateModified": "2026-10-25",
    "image": "https://uselinkpilot.com/logo-512.png",
    "author": {
      "@type": "Organization",
      "@id": "https://uselinkpilot.com/author/linkpilot-team#organization",
      "name": "LinkPilot Team",
      "url": "https://uselinkpilot.com/author/linkpilot-team"
    },
    "publisher": {
      "@type": "Organization",
      "name": "LinkPilot",
      "url": "https://uselinkpilot.com",
      "logo": {
        "@type": "ImageObject",
        "url": "https://uselinkpilot.com/logo-512.png",
        "width": 512,
        "height": 512
      }
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Does an expiring link make the SSH key expire?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. The link controls how long the secret can be retrieved from the link. The key keeps working on the server until you remove it from authorized_keys, or until the certificate it belongs to reaches its own validity date."
        }
      },
      {
        "@type": "Question",
        "name": "Is it safe to share a private SSH key through a one-time link?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "It is far safer than email or chat, because no copy stays behind in the message. It is still a private key in someone else's hands afterwards, so create a dedicated key for them, scope it tightly and remove it when the work ends."
        }
      },
      {
        "@type": "Question",
        "name": "What should I share if the recipient already has an SSH key?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Ask for their public key and add it to the right account on the server. Nothing secret has to move at all, and you can remove that one line later."
        }
      },
      {
        "@type": "Question",
        "name": "Can a link expire before the recipient opens it?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. Pick a window that matches when they will actually be at a keyboard, send it when they are ready, and create a fresh link if the window passes rather than extending the old one."
        }
      },
      {
        "@type": "Question",
        "name": "Can a security scanner or link preview use up a one-time link?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "A fetch that only loads the page does not reveal a LinkPilot secret. The reveal is a deliberate action, and the decryption key sits in the URL fragment that browsers never send to servers, so an automated scanner cannot read the contents. A scanner can still show that a link exists, which is why the username and host travel separately."
        }
      },
      {
        "@type": "Question",
        "name": "Should the username and host go in the same message as the link?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. Keep the link in one message and the connection details in another. Then a single leaked message gives an attacker a link that has already burned, or details they cannot log in with."
        }
      }
    ]
  }
]
```