Deploy keys
If you don't want to register a GitHub App, Conductor can use a per-app read-only SSH deploy key to clone a private repo. The App is recommended (cross-org, self-serve), but deploy keys are a simple self-hosted fallback.
Generate a key
conductor_app_config gen_deploy_key with app_name (or the app page → Deploy Key → Generate). Conductor generates an ed25519 keypair, stores the private half encrypted, and returns the public key.
Add it to GitHub
-
Automatic — if you've stored an org GitHub token (
conductor_githubset_token, a fine-grained PAT with Administration: read/write), Conductor adds the key to the repo for you. - Manual — otherwise, copy the public key to the repo's Settings → Deploy keys → Add deploy key, leave Allow write access unchecked (read-only).
Deploy
The deployer clones via the deploy key automatically. Clone-auth precedence is: GitHub App token → deploy key → plain URL — so if you later connect a GitHub App, it takes over with no per-app changes.