Configure Git with Multi-Account SSH and Verified Commits Using GPG in Github

Throughout time in developments we faced multiple repositories with different git account/credentials. Managing multiple Git accounts and ensuring commit authenticity can be challenging.

This guide simplifies the process by combining multi-account SSH key setup with GPG signing for secure authentication and trusted commits across your Linux, Windows, and macOS workstation.

Why It Matters

1. 
   SSH Keys: Manage multiple accounts securely with password-free access. Essential for handling separate work, personal, or client repositories without confusion.
   


2. 
   GPG Signing: Cryptographically sign commits to prove their authenticity and protect them from tampering—critical for secure, professional or enterprise collaborations.
   


3. This workflow is also apply to other git service provider such as gitlab or bitbucket.
   

Steps

Typical steps to enabling multi-account Git SSH & GPG commit signing, you can check this big picture on how we enabling it.

1. Create SSH Key in workstation for each account with distinct name.


2. Save your SSH Public Key to github.


3. Create gpg key and save to github.


4. Clone using git SSH for push access to the repo.


5. Config the local git repo folder to configure username, email account and signing commit using your gpg key.


6. For complete details you can follow the rest of this article.

1. Setting Up Multi-Account Git with SSH

Step 1: Generate SSH Keys

For each Git account, generate a separate SSH key.

Linux/macOS:

ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/.ssh/id_rsa_personal

ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/.ssh/id_rsa_client

Windows (Git Bash):

ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/ssh/id_rsa_personal

ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/ssh/id_rsa_client

Important notes

• During SSH Key Generation, user is your github username and email is your email registered for your github account.


• " and run:
  
  
  
  
  
  
  

  CODE Kopieren

  gpg --full-generate-key
  
  

  
  
  
  
  
  
  
  

  Choose RSA and RSA (4096 bits) and set an expiry date.

  
  
  

  
  
  
  Step 2: Export the Public Key
  

  
  
  

  Find the GPG key ID:
  
  

  
  
  
  
  

  CODE Kopieren

  gpg --list-secret-keys --keyid-format LONG
  
  

  
  
  
  
  
  
  
  

  Export and copy the key:
  
  

  
  
  
  
  

  CODE Kopieren

  gpg --armor --export <GPG_KEY_ID>
  
  

  
  
  
  
  
  
  
  

  
  
  
  Step 3: Add GPG Key to GitHub
  

  
  
  
  
  
  1. Go to GitHub > Settings > SSH and GPG Keys > New GPG Key.
     
  
  
  2. Paste the public key.
     
  
  
  
  
  
  
  
  

  
  
  
  4. Configuring Repository-Specific Settings
  

  
  
  

  For each repository, configure local Git settings to specify the username, email, and GPG key.
  
  

  
  
  
  
  

  CODE Kopieren

  cd /path/to/repo
  
  git config user.name "Your Name"
  
  git config user.email "[email protected]"
  
  git config user.signingkey <GPG_KEY_ID>
  
  git config commit.gpgsign true
  
  

  
  
  
  
  
  
  
  

  Verify settings with:
  
  

  
  
  
  
  

  CODE Kopieren

  git config --get user.name
  
  git config --get user.email
  
  git config --get user.signingkey
  
  

  
  
  
  
  
  
  
  

  This ensures commits in the repository use the correct identity and are signed.

  
  
  
  
  
  

  
  
  
  5. Using and Verifying Signed Commits
  

  
  
  

  
  
  
  Create a Signed Commit
  

  
  
  
  
  
  
  

  CODE Kopieren

  git commit -S -m "Your commit message"
  
  

  
  
  
  
  
  
  
  

  
  
  
  Verify Signed Commits
  

  
  
  
  
  
  
  

  CODE Kopieren

  git log --show-signature
  
  

  
  
  
  
  
  
  
  

  Git will display the signature status, confirming commit authenticity.

  
  
  
  
  
  

  
  
  
  Conclusion
  

  
  
  

  Combining multi-account SSH key management with GPG signing ensures secure, streamlined workflows for professional developers. Whether you're managing personal, work, or client repositories, this setup keeps your Git environment organized, authenticated, and trustworthy.

  Vollständiger Original-Bericht

  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

  ↗ Original-Artikel auf dev.to lesen