Your SSH key
One key, uploaded once. Superkey installs it on every device you can reach and removes it everywhere the moment your access changes.
Replace this key
Finding or making a key
Your public key is usually at ~/.ssh/id_ed25519.pub. Print it with:
cat ~/.ssh/id_ed25519.pub # Linux, macOS Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub # Windows PowerShell
No key yet? Generate one on the machine you'll connect from, accept the default location, and optionally set a passphrase.
ssh-keygen -t ed25519 -C "you@lvairo.com"
.pub.
The private key never leaves your machine.
No devices yet. Access comes from your Google Workspace groups — ask an admin to attach a label your group can reach.
My agents
A personal agent (your nemo, for instance) runs as you. It gets its own
key and logs in as a dedicated unprivileged account, <you>_<agent>, on exactly the
devices you can already reach. It can never have more access than you do, and you can revoke it at
any time. Shared agents live in the Team agents tab.
| Agent | Logs in as | Key | Source restriction |
|---|
Add or rotate an agent key
Submitting an existing name rotates that agent's key.
Generate the keypair on the machine that runs the agent:
ssh-keygen -t ed25519 -f ~/.ssh/id_nemo -C "nemo agent" cat ~/.ssh/id_nemo.pub
Team agents
Shared nemo agents. They register themselves with no access; you grant it by attaching
labels, and the agent then reaches every device carrying one, as
agent_<name>. You can attach the labels you hold yourself; admins can attach any.
Changes take effect on the next deploy.
| Agent | Logs in as | Key | Labels |
|---|
Nothing matches that filter.
Labels
A label ties devices to groups. Devices carry labels; groups are granted labels; people reach a device when one of their groups holds one of its labels.
| Label | Devices | Groups with access |
|---|
Groups
Membership is synced from Google Workspace and can't be edited here.
| Group | Google group | Members | Labels held |
|---|
Users
| Name | Key | Groups |
|---|