Your devices, keys and iCloud

Last updated: 2026-10-31

Each of your devices logs in to your hosts with a key of its own, made on the device and never copied off it. Your hosts, snippets, triggers and the host keys you trust follow you to your other devices through iCloud, so a host added on the Mac is on the iPhone, ready to open. Keys and passwords never sync.

This page is about those keys, your devices and what iCloud carries. For what SpectaShell keeps private and why, see Security and privacy.

The Keys page#

On the Mac and the iPad, choose Keys in the sidebar, under Library. On the iPhone, open the Settings tab and choose Keys under Connections.

The page shows, from the top:

• This device's key: its name, its kind, its Fingerprint, when it was Made, and On hosts, the hosts SpectaShell put it on. Copy Public Key copies its line for authorized_keys; Share Public Key sends it by Messages, Mail or another app.
• Listing key: this device's second key and its fingerprint (see The listing key).
• Earlier keys of this device, when there are any (see When the device makes a new key).
• Your Other Devices: your other devices that use SpectaShell, each with its keys and where it stands (see Your other devices).
• On the Mac, In ~/.ssh and the SSH agent: your own keys (see Your own keys on the Mac).

On hosts lists only the hosts SpectaShell put the key on itself. A host you added the key to by hand is not listed, though the key works there.

The device key#

The device key is made on the device the first time SpectaShell needs it. Its private half is never exported.

• Where it lives. On an iPhone, an iPad and a Mac with Apple silicon or a T2 chip, the key is made in the Secure Enclave, and the page shows it as "ECDSA P-256 · Secure Enclave": the private key cannot leave the chip, and nothing, SpectaShell included, can copy it. On a Mac without a Secure Enclave it is an Ed25519 key kept in this Mac's keychain, shown as "Ed25519 · this device's Keychain", and never synced.
• It asks you first. Each time a host accepts the key at a login, SpectaShell asks for Face ID, Touch ID or your device's password before the key signs. A Secure Enclave key cannot sign at all until you have answered, so someone holding your unlocked device cannot log in with it. Connections made at the same moment, such as the tabs restored at launch, share one check. If you cancel the check, the connection stops.
• Only when a host takes it. SpectaShell offers the key after your own keys, and asks for Face ID only when the host says it accepts the key. A host that does not know the key asks for a password as usual, and asks nothing of Face ID.

Putting the key on a host#

A host learns the device key after one password login from this device.

1. Connect to the host and log in with its password (or a one-time code).
2. SpectaShell asks Log in to host with this device's key from now on?, with the key's Fingerprint and its Comment.
3. Choose Add Key. SpectaShell adds the key's line to ~/.ssh/authorized_keys on the host, and takes out the lines of this device's earlier keys there. Not Now leaves the file as it is; you are asked again at the next password login.

From then on that host logs you in with the key, after Face ID, Touch ID or your device's password.

The line's comment names the device: SpectaShell on iPad-Pro-11-inch-(M5), the device's name with its spaces as dashes, so you can tell your devices' lines apart when you read the file. A key the host already holds is never added twice, even under another comment (keys added by early builds say sdTerm on …).

SpectaShell does not offer the key on a host of a team someone else shares with you, while it waits for iCloud, or while this device is taken off your hosts (see Teams and Keys wait for iCloud).

To put the key on a host by hand instead, use Copy Public Key and add the line to ~/.ssh/authorized_keys there.

When the device makes a new key#

A Secure Enclave key either asks for you or it does not, and that is fixed when it is made. A device with no passcode cannot ask, so its key is made without asking. When you later set a passcode, or turn the passcode off, SpectaShell makes a new key the next time it loads it.

• Each host then needs one password login from this device, and Add Key, to learn the new key. Adding it takes the earlier key's line out of that host's authorized_keys.
• Earlier keys of this device, marked "kept for reference", lists the keys replaced, with when each was replaced and how many of the hosts it was on it has been taken out of ("removed from 2 of 3 hosts").

The same happens after Make New Keys…: see When this device was taken off.

The listing key#

Each device also has a listing key. It can do one thing on a host: list the shells kept there, with their names and last lines, for Running. It signs with no Face ID, so Running can show every kept shell on every host without asking you anything, including shells you started on another device on a host this device has never logged in to.

The host itself enforces the limit, not SpectaShell. The listing key's line in authorized_keys starts with options:

restrict,command="$HOME/.local/share/spectashell/current/spectashell-keeper list" ecdsa-sha2-nistp256 AAAA… SpectaShell listing on MacBook-Pro

restrict gives the key no terminal, no port forwarding, no agent and no files, and command= runs the keeper's list whatever the connection asks for. Someone holding your unlocked device could use it only to read the names and last lines of the shells kept on your hosts, which Running shows anyway. Opening a shell still asks for Face ID.

Listing keys go on a host by themselves, beside the login:

• When one of your devices logs in to a host with a key — the device key, or on the Mac one of your own keys — it puts its own listing key there, and those of your other devices that are approved (see Approving a new device).
• A host you log in to only with a password gets them once you choose Add Key.
• A team's host someone else shares gets none by itself; its owner lets you in with yours (see Teams).
• A listing key of a device taken off your hosts goes on no host again.

Your other devices#

Your Other Devices on the Keys page lists your other devices that use SpectaShell with the same Apple Account. Each row shows the device's name, its Login key with its kind and fingerprint, its Listing key fingerprint, and where it stands:

• Approved from device on date: your devices put its listing key on your hosts.
• Waiting for your approval: a new device, whose listing key goes on no host yet.
• Taken off your hosts on date from device.: its keys were removed (see A lost or sold device).

A device that has not run this version yet says "Login key not published: the device has not run this version yet".

The buttons on each row are offered only on a device that is approved itself: Approve… for a device that waits, and Remove from Every Host…, or Remove Again… for one already taken off.

The list needs iCloud: with sync off, or not signed in to iCloud, devices do not see each other (see Syncing through iCloud).

Approving a new device#

Anyone signed in to your Apple Account gets your hosts on their device. So a new device waits until one of your approved devices approves it; until then your other devices do not put its listing key on your hosts. It still logs in to your hosts as before, with a password and its own device key.

The first device of all approves itself, together with the devices you already had, the first time it reads iCloud: you approve only devices added after that.

On the new device, the Keys page says This device waits for your approval. To approve it:

1. On a device of yours that is approved, open Keys.
2. Under Your Other Devices, find the device marked "Waiting for your approval" and choose Approve….
3. Read the question, Approve device?, and check that the fingerprint it shows is the one on the new device's Keys page. Approve a device only if it is in your hands: a device of someone signed in to your Apple Account would wait here too.
4. Choose Approve, then confirm with Face ID, Touch ID or your device's password.

Your devices put its listing key on your hosts at their logins from then on. Approval is of the device's keys: a device that makes new keys waits again.

When no approved device is at hand#

If the only device that could approve this one was lost, a waiting device can start over. On its Keys page, choose Start Over…, read the question, Start over from this device?, choose Start Over, and confirm with Face ID, Touch ID or your device's password.

Every other device's keys are then taken off your hosts, at the next login to each, and this device is approved. Each of your other devices then shows that it was taken off, makes new keys with Make New Keys…, and waits for you to approve it from here.

Use Start Over only when none of your approved devices is at hand: it takes every other device off.

A lost or sold device#

When a device is lost, stolen or sold, take it off your hosts from another of your devices:

1. On a device of yours that is approved, open Keys.
2. Under Your Other Devices, choose Remove from Every Host… on the device's row.
3. Read the question, Remove device from every host?, and choose Remove from Every Host. Confirm with Face ID, Touch ID or your device's password.
4. A sheet, Removing device, logs in to each host in your host book, one after another, and takes the device's login key and listing key out of authorized_keys there. Each host may ask for Face ID or its password.

Each host's line on the sheet says how it went: Taken off: 1 line, Its keys were not there, or why it could not be done, such as a host that was off. Try Again on 2 Hosts tries those once you can reach them. Choose Done to close the sheet.

What happens:

• Its notifications from your hosts stop.
• The device's keys never go on a host again. Lines are found by their key, not by the device's name in the comment, so a line of another device with the same name is never taken.
• Every login of any of your devices, to any host, takes the keys off that host too. A host that was off, or that you add later, loses them at the next login. Hosts of your teams are tried as well.
• The device doing the removal keeps its own keys: SpectaShell never takes off the key it logs in with.
• A host that is not in your host book is changed only when one of your devices logs in to it.

SpectaShell cannot erase the device. Also erase it in Find My and remove it from your Apple Account: whoever holds it may be signed in to your iCloud.

When this device was taken off#

A device taken off your hosts says so at the top of its Keys page: This device was taken off your hosts, with when and from which device. Its keys came out of your hosts' authorized_keys, and while they are revoked it puts no key on any host. If you did not do it, change your Apple Account's password: someone else is signed in to it.

To use the device again:

1. Choose Make New Keys…, then Make New Keys, and confirm with Face ID, Touch ID or your device's password. Its old keys are deleted from the device for good, and new ones are made.
2. On another of your devices, approve it (see Approving a new device).
3. Log in to each host once with its password, and choose Add Key.

A device cannot give itself back: a key taken off goes on no host again, even if SpectaShell is deleted and installed again.

Your own keys on the Mac#

On the Mac, SpectaShell also logs in with the keys you already use with ssh: the keys in ~/.ssh and those in your SSH agent. It reads them and never changes them.

• At a login it tries, in the order OpenSSH does: your agent's keys, your key files, then the device key, then a one-time code or the password.
• A key file with a passphrase is decrypted only when the host accepts that key. Its passphrase is asked then, and not stored anywhere.
• The Keys page lists them under In ~/.ssh and the SSH agent, "used by SpectaShell, owned by you": each key's file (or, for a key only in the agent, its comment), its fingerprint, its kind, where it is ("~/.ssh", "agent" or both) and "read-only".

The iPad and iPhone have no ~/.ssh: they log in with the device key, a password or a code.

Syncing through iCloud#

SpectaShell syncs through your own iCloud, in the private database of your Apple Account. SpectaShell has no server, and no account of its own.

What syncs and what stays#

A cloud's credentials stay in the Keychain. If you turned on On All Devices when you added the cloud, iCloud Keychain brings them to your other devices; SpectaShell's sync never holds them.

A group you share with a team syncs with the people you share it with (see Teams).

How it works#

• Changes you make are sent a moment after you make them. Another device's changes arrive when iCloud tells SpectaShell of them, and SpectaShell reads everything from iCloud at launch, when you choose Sync Now, and when it comes forward after five minutes or more away.
• When two devices change the same host, the later change wins. Two hosts added at once on two devices are both kept.
• A host key you trust on one device is trusted on the others, so they do not ask again. A key that changed is still refused on every device (see Security and privacy).

Sync settings#

Open Settings: on the Mac, SpectaShell ▸ Settings…, then This Device; on the iPad, the gear at the top of the sidebar, or your device's name at its foot; on the iPhone, the Settings tab. The iCloud section has:

• Sync Through iCloud: on at first. Turned off, nothing is sent or received, and what is on the device stays as it is. Turned on again, the changes you made meanwhile are sent.
• Status: Up to date with the time of the last sync, Syncing…, Off, Not signed in to iCloud, or what went wrong.
• Sync Now: reads everything from iCloud, then sends what changed here.

On the Mac and the iPad, the line under your device's name at the foot of the sidebar says the same in short: "Synced 2 min. ago", "Syncing…", "Sync is off" or "Not signed in".

Teams need sync: with it off, Share… and the other team actions are not offered.

Keys wait for iCloud#

When SpectaShell starts with sync on, it puts no key on any host by itself until it has read iCloud: it offers no Add Key, and puts no listing key anywhere. A device that has not yet heard of a team you joined could otherwise write to a teammate's account. While it waits:

• on the Mac and the iPad, the sidebar's device row says Keys wait for iCloud;
• Settings' iCloud section shows Keys on Hosts: Waiting for iCloud.

It ends as soon as iCloud has been read, usually seconds after launch. A device started offline waits until it is back online. With sync off, or no iCloud account, nothing waits.

Naming this device#

Your devices name each other by the name each gives itself: in Running ("on iPad Pro 11-inch (M5)") when one holds a shell, in Your Other Devices, and in the comment of its key in hosts' authorized_keys.

At first the name is the Mac's own, or the iPad's or iPhone's model, since iPadOS and iOS tell an app only "iPad" or "iPhone". To change it, open Settings (see Sync settings), and type a name under This Device. Leave it empty to go back to the device's own name.

The new name is used from then on. A key already on a host keeps the comment it was added with.

Good to know#

• SpectaShell never imports keys, and has no vault: a key made on one device stays there, and your own keys stay in ~/.ssh on the Mac.
• A new device needs one password login to each host to put its own key there; approving it only lets its listing key on.
• Removing a device from every host does not touch a host that is not in your host book until one of your devices logs in to it.
• A build of SpectaShell not signed for iCloud says "This build of SpectaShell is not signed for iCloud." in Settings, and syncs nothing.