Getting a Server for AgentAura: SSH, Keys and Tokens 🔑

AgentAura installs a private AI agent onto a Linux server that you own. If you have never rented a server before, the hard part is not the agent. It is the half hour in a cloud console: which account, which image, which size, which key, which user, which firewall rule.

This guide is the part that applies to every provider. It explains the two ways AgentAura gets onto a server, what that server must have, and how to make an SSH key that AgentAura accepts. At the end there is a step-by-step guide for each of eight providers.

🧭 Two Ways onto a Server

My Server works with every provider, because all it needs is SSH. You create the server in the provider's console, then hand AgentAura the address and a credential. This is the path the rest of this guide assumes.

The token path saves you the console, but only for the providers your app lists. The server is still created in your account and billed to you by the provider. If your app does not show a provider option, use My Server. For DigitalOcean, Linode, AWS, Google Cloud, Azure and Oracle, AgentAura does not use their API keys at all. Creating one "because a tutorial said so" only adds a credential you then have to protect.

🖥️ What the Server Needs

The background on sizing is in What Kind of Server Do You Need to Run a Private AI Agent?.

🔑 Make an SSH Key That AgentAura Accepts

A password works on providers that give you one. A key is safer, and on AWS, Google Cloud, Azure and Oracle it is the normal way in. Make a new key just for this server:

# macOS or Linux
mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/agentaura -N "" -C "agentaura"

# Windows 10 or 11, in PowerShell. When asked for a passphrase, press Enter twice.
New-Item -ItemType Directory -Force "$HOME\.ssh" | Out-Null
ssh-keygen -t ed25519 -f "$HOME\.ssh\agentaura" -C "agentaura"

That creates two files:

• agentaura.pub is the public key. You give this one to the cloud provider.
• agentaura (no extension) is the private key. You paste this one into AgentAura.

Four rules decide whether AgentAura accepts the key:

1. Paste the private key, and all of it. That includes the -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY----- lines. The .pub file is not a login credential.
2. No passphrase. AgentAura has no passphrase field, so a key protected by one will not log in. That is why the commands above leave it empty, and why the key should be used for this server only.
3. OpenSSH or PEM format. A key a provider generated for you as a .pem download (AWS, Azure and Oracle do this) can be pasted as it is. A PuTTY .ppk file cannot: open it in PuTTYgen and use Conversions → Export OpenSSH key first.
4. ed25519, RSA or ECDSA. All three work. ed25519 is the short, modern choice.

To show the private key so you can copy it:

cat ~/.ssh/agentaura                   # macOS / Linux
Get-Content "$HOME\.ssh\agentaura"     # Windows PowerShell

🔓 Leave SSH Reachable, and Only SSH

Two firewall mistakes account for most failed first deployments.

Restricting SSH to "My IP". Several consoles suggest it. But AgentAura connects to your server from its own cloud, not from your computer, and not only during the install: viewing logs, restarting, reconnecting a model credential, adding agents and updating all happen over SSH. A rule that only admits your home address blocks every one of those. Leave the SSH port open to the internet and rely on key authentication, which is what makes an open SSH port safe.

Opening other ports "just in case". Nothing else needs to be reachable. The installer sets up an outbound Cloudflare Tunnel, and your clients reach the agent through it. Extra inbound ports add exposure and fix nothing.

✍️ What to Type into AgentAura

The login user depends on the provider's image:

⏳ Before You Press Deploy

Log in once yourself, with the same user and key you are about to give AgentAura:

ssh -i ~/.ssh/agentaura root@203.0.113.10
# Windows PowerShell: ssh -i "$HOME\.ssh\agentaura" root@203.0.113.10

Use your server's address and the right user from the table. A server that the console calls "running" may still be booting, or running its first package upgrades, which lock apt for a few minutes. If your own login works and the prompt comes back promptly, start the deployment in AgentAura and watch its output: each step is reported, and a failure says which step and why. The quick start covers the model credential you choose next.

📚 Step-by-Step, by Provider

• Hetzner Cloud: SSH setup, plus the API token some apps use to create the server for you
• DigitalOcean: a Droplet with your key, logged in as root
• Vultr: SSH setup, plus the API key and its access-control list for the Windows app
• Akamai Cloud (Linode): a Linode with your key, logged in as root
• AWS: EC2, key pairs, and the security-group rule people get wrong
• Google Cloud: Compute Engine and SSH keys in metadata
• Microsoft Azure: a Linux VM with a generated key pair
• Oracle Cloud: why the Always Free ARM instance will not work, and what will

Other providers work the same way. If they give you an x86 Ubuntu server with a public IP and SSH, use My Server.

💰 Two Bills, and the One Step People Forget

The server is billed by your provider from the moment it exists until you delete it. Model usage is billed by whichever AI provider's credential you give the agent. They are separate.

Removing an agent in AgentAura does not delete the server, and neither does a failed deployment. When you are done, delete the server in the provider's console. On most providers a stopped server still costs something: at least its disk, and sometimes the full price.