Password auth works, but a key pair is faster to use, harder to brute-force, and required if you want git push-to-deploy to feel seamless. Here's the full setup.
1. Generate a key pair
If you don't already have one, generate an ed25519 key (smaller and faster than RSA, and plenty strong):
Leave the default file location unless you have a reason to change it, and set a passphrase if this is a machine other people can access.
2. Add the public key in cPanel
Copy your public key
Run cat ~/.ssh/id_ed25519.pub and copy the entire output, it starts with ssh-ed25519.
Open Manage SSH Keys
In cPanel, go to Security → SSH Access → Manage SSH Keys → Import Key.
Paste and authorize
Paste your public key in, give it a name, save it, then click Manage on the new key and authorize it. Unauthorized keys are stored but won't grant access.
3. Test the connection
If you're prompted for a password instead of logging straight in, double check the key was authorized in cPanel and that you're pointing at the right private key with -i ~/.ssh/id_ed25519 if it's not in the default location.
Optional: disable password login entirely
Once key auth is working, you can turn off password-based SSH login for the account under Security → SSH Access for one less attack surface. Make sure your key works first, there's no recovery path if you lock yourself out.