Set up SSH key authentication for your SFTP app

Your existing SFTP app can authenticate to a district's server with an SSH key pair instead of a username and password. When enabled, SchoolDay generates a 2048-bit RSA key pair and stores the private key securely — it is never displayed.

Requirements

Vendor Admin permissions.
An existing SFTP app. This article does not cover creating a new app.
Availability depends on how the data exchange was initiated — see below.

When you can use an SSH key

Whether you can configure a key depends on who started the data-sharing request:

Who initiated the request	Available authentication
The district sent you a request	Password or SSH key. Configure the key on that request. See Manage data sharing requests from a district.
You sent the request to the district	Password for initial setup. Once the integration is created, you can switch to an SSH key in the integration settings. See below for details See below for details.

If you require key-based authentication for a request you initiated, ask the district to send a data-sharing request. Alternatively, complete the setup and configure an SSH key in Sync Settings after creating the integration.

Set up an SSH key on a district-initiated request

Use this flow if the district initiated the data-sharing request. The key is generated and configured directly on that request.

Go to the data-sharing request from the district. See Manage data sharing requests from a district.
Open the SFTP configuration for the request.
Click Use SSH Key Instead.
Copy the displayed public key.
Add the public key to the authorized_keys file on your SFTP server.
Click Test Connection to confirm the district's server can connect.

Set up an SSH key from your integration settings

If your SFTP app already has an active integration with a district — regardless of how the data exchange was initiated — and that integration is currently using password authentication, or was created without any credentials configured, you can generate an SSH key pair directly from the integration's settings.

Go to your SFTP export app.
Open the integration with the district.
Go to the integration's Settings.
Click Use SSH Key Instead.
Copy the displayed public key.
Add the public key to the authorized_keys file on your SFTP server.
Click Test Connection to confirm the connection works.

Verify the configuration

Test Connection returns a success message.
The next scheduled export from the district completes without an authentication error.

Regenerate a key pair

If the remote server requires a new key (e.g., following a security review), click Generate SSH key pair again. This replaces the stored key pair. Register the new public key on the remote server before the next export run, or the connection will fail.

Switch between authentication types

Switching from password-based to key-based authentication is permanent for that data source. Once a key is generated, you cannot revert to password-based authentication.

Troubleshooting

Symptom	Cause	Fix
Generate SSH key pair option isn't available	The request was initiated by you, not the district	Ask the district to send the data-sharing request instead, or configure an SSH key later from Sync Settings once the integration is created
Test Connection fails after generating a key	The public key hasn't been added to your server's `authorized_keys` file	Copy the public key again and confirm it's registered on your server
Export from the district fails with an authentication error	The key on your server doesn't match the current key in SchoolDay	Check whether the key was regenerated since your server was last updated; re-register the current public key

Next steps

Remove this header table before publishing.