Skip to main content

Secure File Transfer Setting: SSH Key and GPG Generation Guide (MacOS)

Overview

This guide helps you send files to Alloy and get files from Alloy safely. It has two parts. Each part works on its own.

  • SFTP Hosting. SFTP is a safe way to move files between computers. First, pick who runs the SFTP server: Alloy or you. Then share the SSH key that lets one side log in to the server.

  • Additional Encryption. Encrypting a file scrambles it so only someone with the right key can read it. GPG keys let you encrypt the files you send and get. You can set this up no matter who runs the server.

Each key has two parts. The private key stays secret with its owner. The public key is safe to share. On this page, you only ever paste or copy public keys.

To set up both parts, go to Settings → Files in the Alloy dashboard.

Part 1: SFTP Hosting

Under SFTP Hosting, the page asks, "Who hosts the SFTP server?" Click a tile to see the key you need. The page doesn't save which tile you picked. Each time you open the page, no tile is selected.

Option A: Alloy hosts the server

Your files are stored on Alloy's SFTP server. You log in to it with your own SSH key. So you make a key and give Alloy the public part.

Make an SSH key in Terminal:

  1. Open the Terminal app.

  2. Run: ssh-keygen -t rsa -b 4096

  3. Press Enter to save the key in the usual place (~/.ssh/id_rsa).

  4. When asked, type a passphrase. You won't see it as you type. Then type it again to confirm.

  5. Terminal shows a fingerprint and a small picture made of text. This means your key is ready.

Alloy also accepts Ed25519 keys (ssh-keygen -t ed25519). If you make one, your public key file is ~/.ssh/id_ed25519.pub instead.

Copy your public key in one of two ways:

  • In Terminal, run: pbcopy < ~/.ssh/id_rsa.pub

  • Or open ~/.ssh/id_rsa.pub in a text editor and copy all of it.

Add the key in Alloy:

  1. Go to Settings → Files.

  2. Under SFTP Hosting, click the Alloy hosts the server tile.

  3. Under "Your SSH public key," click Add your SSH public key.

  4. Paste your key in the box and click Save.

Your key now shows on the page. You can see it, but you can't change it. Alloy uses this key to check that it's you when you upload files.

Option B: You host the server

Your files are stored on your own SFTP server. Alloy needs its own key to log in to your server. You don't need to make a key.

  1. Go to Settings → Files.

  2. Under SFTP Hosting, click the You host the server tile.

  3. Under "Alloy's SSH public key," click Generate key.

  4. Click Copy.

  5. On your SFTP server, add the key as an authorized key for the account Alloy will log in with.

Part 2: Additional Encryption (GPG)

Under Additional Encryption, you can share GPG keys to encrypt files. This part doesn't depend on who hosts the server. Set it up either way.

There are two keys, one for each direction. You can set up one or both.

Files Alloy sends you: add your GPG public key

Use this so Alloy can encrypt the files it sends you. Only you can decrypt them.

Make a GPG key in Terminal:

  1. Open Terminal.

  2. Run: gpg --full-generate-key

  3. Pick a key type. The default is ECC.

  4. Pick a curve. The default is Curve 25519.

  5. Pick when the key expires. The default is never. Then confirm.

  6. Enter your real name, your email, and a comment.

  7. Type a passphrase. It shows as stars. Then type it again to confirm.

  8. Look over the key details that Terminal shows.

  9. Export your public key: gpg --armor --export <key>. Copy the whole block, including the BEGIN and END lines.

Add the key in Alloy:

  1. Go to Settings → Files.

  2. Under Additional Encryption, find "Your GPG public key." Click Add your GPG public key below it.

  3. Paste your key in the box and click Save.

Files you send Alloy: use Alloy's GPG public key

Use this to encrypt files before you send them to Alloy. Only Alloy can decrypt them. You don't need to make a key.

  1. Go to Settings → Files.

  2. Under Additional Encryption, find "Alloy's GPG public key." Click Generate GPG Key.

  3. A window opens. Pick an Algorithm. ECC (Curve25519) is the default. You can also pick RSA-4096. Then click Generate GPG Key.

  4. The key shows on the page with its GPG Key Fingerprint. Click Copy.

  5. Use the key to encrypt files before you upload them to Alloy. For example: gpg --encrypt --recipient-file <key-file> <file-to-send>

Check that the key's fingerprint matches the GPG Key Fingerprint on the page. This makes sure you have the right key.

Get a new Alloy GPG key:

  1. Next to Alloy's GPG public key, click Regenerate key.

  2. Pick an Algorithm and click Regenerate key.

NOTE: You can't undo this. Once you do it, the old key is gone for good. Files you already sent or encrypted with the old key will fail, because Alloy can't open them. Start using the new key right away.

Troubleshooting

GPG command not found

This means GPG isn't installed on your Mac. Install it in one of two ways:

Did this answer your question?