feat: multi-account OAuth auth + SSH key publishing (GitHub / Bitbucket)

[bagdevich]

🚀 Feature: Multi-account OAuth + SSH key publishing

Problem

Currently gitkey manages SSH keys locally via ~/.ssh/config, but:

• users must manually add public keys to GitHub / Bitbucket
• no connection between SSH profiles and actual accounts
• no way to automate key provisioning
• poor UX when working with multiple accounts (work / personal)

---

Goal

Enable full flow:

gitkey generate → gitkey login → gitkey publish-key → gitkey use

So that:

• SSH keys are generated
• automatically uploaded to the correct account
• linked to the correct SSH host alias

---

Core Idea

Introduce multi-account, multi-provider authentication layer.

Key concept:

SSH Host alias becomes the primary identity unit.

Example:

Host gh-work
Host gh-personal
Host bb-work

Each alias is mapped to:

provider + account + token

---

Architecture

1. Token storage (secure)

Use macOS Keychain via keytar.

service: gitkey
account: github:gh-work
account: github:gh-personal
account: bitbucket:bb-work

---

2. Metadata storage

~/.config/gitkey/accounts.json

{
  "gh-work": {
    "provider": "github",
    "username": "bagdevich"
  }
}

---

3. OAuth flow

Use GitHub Device Flow (CLI-friendly).

Command:

gitkey login github gh-work

Flow:

1. Request device code
2. Show user code + URL
3. User authorizes in browser
4. CLI receives access token
5. Store token in Keychain

---

4. Publish SSH key

gitkey publish-key gh-work

Steps:

1. Read IdentityFile from .ssh/config
2. Load .pub key
3. Load token from Keychain
4. Call API:

POST /user/keys

Body:

{
  "title": "gitkey-gh-work-MacBook",
  "key": "ssh-ed25519 ..."
}

---

Commands to implement

gitkey login <provider> <alias>
gitkey logout <alias>
gitkey whoami
gitkey publish-key <alias>

---

Supported providers

GitHub (priority)

• OAuth Device Flow
• Scope: write:public_key

Bitbucket (future)

• OAuth
• SSH key API integration

---

Challenges / Risks

• token storage security
• handling multiple accounts per provider
• ensuring correct mapping alias ↔ account
• API differences between GitHub and Bitbucket
• rate limits / auth errors

---

Future improvements

• auto-publish key on generate
• account-aware prompts
• multi-device sync
• Windows support
• revoke keys via CLI

---

Why this matters

This transforms gitkey from:

SSH helper

into:

full Git identity manager

---

Status

• design
• GitHub OAuth
• token storage
• publish-key
• Bitbucket support