sign_and_send_pubkey: signing failed for RSA "/path/to/key" from agent: agent refused operation

The key type and the identity path vary (`RSA`, `ED25519`, `ECDSA-SK`…). OpenSSH 8.3 and earlier printed the shorter "sign_and_send_pubkey: signing failed: agent refused operation" (checked in the 7.9 and 8.4 sources).

What it means

The server accepted the offered public key, so ssh asked the SSH agent to sign the authentication challenge — and the agent declined. The key exists, the server would accept it; the private-key operation itself did not happen. Agents refuse when they need user interaction they cannot get (a confirmation, a PIN, a touch), or when the key material behind the listed key is no longer usable.

Why it happens

• The agent needs a confirmation it cannot display

  common

  Keys added with `ssh-add -c`, 1Password/Bitwarden/Secretive agents that ask for approval, or macOS keychain prompts, while ssh runs over SSH, in a container or without a GUI session (`SSH_ASKPASS` missing).

• Hardware token or gpg-agent cannot sign

  common

  A YubiKey/smart card that was removed or not touched in time, a locked PIV PIN, or gpg-agent without a usable pinentry (no `GPG_TTY`). The agent still lists the key but cannot use it.

• The agent's key and the identity file disagree

  occasional

  `-i ~/.ssh/key` with a `.pub` file that belongs to another key, or a key replaced on disk while the agent holds the old one. Reloading the key into the agent fixes it.

How to fix it

1. 1.

   Find out which agent answers and reload the key

   `SSH_AUTH_SOCK` tells you which agent is in use; `ssh-add -l` lists what it holds. Removing and re-adding the key clears stale entries.

   echo "$SSH_AUTH_SOCK"      # which agent answers: ssh-agent, gpg-agent, 1Password, ...
   ssh-add -l                 # keys the agent holds
   ssh-add -D && ssh-add ~/.ssh/id_ed25519   # reload a key that the agent cannot use anymore

2. 2.

   Give gpg-agent a terminal for prompts

   When gpg-agent serves SSH keys, it shows PIN prompts on the TTY it was told about; update it from the current shell.

   # gpg-agent as SSH agent: tell it which terminal can show the PIN/confirmation prompt
   export GPG_TTY=$(tty)
   gpg-connect-agent updatestartuptty /bye

← Browse the full signature error database