How to fix Could not open a connection to your authentication agent. in SSH

The SSH agent must be started and its environment variables exported to your shell. Use the eval command to do this correctly:

eval $(ssh-agent -s)

Or if you're using a C-shell compatible shell (csh/tcsh):

eval 'ssh-agent -c'

Or if you're using fish shell:

ssh-agent /usr/bin/fish

The eval command is critical—it ensures the SSH_AUTH_SOCK and SSH_AGENT_PID environment variables are exported to your current shell. Simply running ssh-agent alone won't set up these variables for your session.

After starting the agent, verify the environment variables are set:

echo $SSH_AUTH_SOCK
echo $SSH_AGENT_PID

Both should print non-empty values. If they're empty, the ssh-agent didn't start correctly. Try the previous step again or check for errors in the output.

You can also list running SSH agents:

ps aux | grep ssh-agent

You should see a process like: /usr/bin/ssh-agent

Once the agent is running, add your private key to it. For the default key location:

ssh-add ~/.ssh/id_rsa

If your key has a different name or location, replace ~/.ssh/id_rsa with the correct path.

You may be prompted for the key's passphrase (if it has one). After entering it, the key is loaded into the agent and won't require the passphrase again during this session.

Verify the key was added:

ssh-add -l

This lists all keys currently loaded in the agent.

To avoid manually starting the agent each time you open a terminal, add initialization code to your shell configuration file.

For bash, add this to ~/.bashrc:

if [ -z "$SSH_AUTH_SOCK" ]; then
  eval $(ssh-agent -s)
  ssh-add ~/.ssh/id_rsa 2>/dev/null
fi

For zsh, add this to ~/.zshrc:

if [ -z "$SSH_AUTH_SOCK" ]; then
  eval $(ssh-agent -s)
  ssh-add ~/.ssh/id_rsa 2>/dev/null
fi

For fish, add this to ~/.config/fish/config.fish:

if not set -q SSH_AUTH_SOCK
  eval (ssh-agent -c)
  ssh-add ~/.ssh/id_rsa 2>/dev/null
end

The if check prevents starting multiple agents if you open multiple terminals. After editing your shell config, reload it:

source ~/.bashrc  # or ~/.zshrc, ~/.config/fish/config.fish

If you're using systemd on Linux (most modern distributions), enable the SSH agent socket:

systemctl --user enable --now ssh-agent.socket

If this succeeds, you should no longer need to manually start ssh-agent.

For GNOME desktop users on recent systems with GNOME Keyring v46+, the SSH agent functionality may be in a separate package. Check if gcr-ssh-agent is active:

systemctl --user status gcr-ssh-agent.socket

If it's not active, enable it:

systemctl --user enable --now gcr-ssh-agent.socket

Then set the SSH_AUTH_SOCK environment variable in your shell config:

export SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/gcr/ssh

Windows users with OpenSSH installed may need to enable the SSH Agent service.

1. Open Services (press Win + R, type services.msc, and press Enter)
2. Look for "OpenSSH Authentication Agent"
3. If it's stopped, right-click and select "Start"
4. Set the startup type to "Manual" or "Automatic" (some users report "Manual" works better than "Auto")

Alternatively, start it from PowerShell as administrator:

Start-Service ssh-agent

If the service doesn't exist, ensure OpenSSH for Windows is properly installed.

Sometimes the SSH_AUTH_SOCK environment variable points to a socket file that no longer exists (stale socket).

Check if the socket file exists:

ls -la $SSH_AUTH_SOCK

If you get "No such file or directory," the socket is stale. Unset the variable and restart the agent:

unset SSH_AUTH_SOCK
unset SSH_AGENT_PID
eval $(ssh-agent -s)
ssh-add ~/.ssh/id_rsa

This clears any stale references and starts a fresh agent.