> ## Documentation Index
> Fetch the complete documentation index at: https://www.thundercompute.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH on Thunder Compute

> Set up SSH access for Thunder Compute instances. Configure public key authentication and establish secure remote connections for terminal operations.

<Columns cols={3}>
  <Card title="VS Code" icon="window" color="#95c5ea" className="platform-card platform-current">
    Editor extension
  </Card>

  <Card title="CLI" icon="terminal" href="/cli/operations/ssh" color="#95c5ea" className="platform-card">
    Command line
  </Card>

  <Card title="Console" icon="browser" href="/console/operations/ssh" color="#95c5ea" className="platform-card">
    Web interface
  </Card>
</Columns>

<Warning>
  Manually SSHing is an advanced escape hatch. Thunder Compute already handles SSH, port forwarding, and key rotation through the **CLI**, **VS Code extension**, and **console**. Stick to the standard connect flows unless you have existing infrastructure that relies on raw SSH.
</Warning>

## Save an SSH key

The VS Code extension uses the same saved keys as the console. Open [Authentication → SSH Keys (Advanced)](https://console.thundercompute.com/settings/ssh) in the console to add or remove organization keys.

Saved keys live at the org level, so everyone on your team can reuse them when creating instances.

## Attach a key when creating an instance

The create-instance dialog in the VS Code extension lets you pick any key from your saved list. New windows reuse it automatically.

Instances include the selected public key in `authorized_keys` at boot. You can add keys later via the [Add SSH key to instance](/api-reference/instances/add-ssh-key-to-instance) API endpoint.

## SSH manually

1. Find the instance IP and SSH port from the instance details in the Thunder Compute sidebar (hover over an instance to see the tooltip), or run `tnr status` in a terminal. The port is shown alongside the IP as `IP:Port` (e.g., `203.0.113.5:12345`). The port is **not always 22** and varies per instance.

2. From your local machine, run SSH with the private key that matches the saved public key, the reported port, and the `ubuntu` user:

   ```bash theme={null}
   ssh -i ~/.ssh/id_ed25519 -p <port> ubuntu@<instance-ip>
   ```

   Replace `~/.ssh/id_ed25519` with your private key path. Substitute `<port>` with the value from instance details. Most images use the `ubuntu` user; check your template if it differs.

3. Optional: use the command with JetBrains Gateway or any remote-SSH client.

## Quick troubleshooting

* **Permission denied:** make sure you are connecting as `ubuntu`, using the `-p <port>` from instance details, and that the matching private key exists locally.
* **Connection timed out:** re-check that you copied the correct port; the IP stays stable, but the exposed port can change if the instance is cycled.
* **Host verification failed:** remove the old entry from `~/.ssh/known_hosts` and retry. New IPs will change fingerprints.
* **Still stuck?** Double-check the IP, port, and key, or send a message in [Discord](https://discord.com/invite/thundercompute) with the SSH output.