Skip to content
English
More support Customer portal
  • There are no suggestions because the search field is empty.

Authenticate SFTP exports with a password or SSH key

Learn how to select and configure authentication for SFTP export data sources.

In this article

SFTP export data sources can be authenticated using either standard credentials or SSH key pairs, depending on your security requirements:

  • Password-based authentication: Best suited for servers supporting standard password logins. This default method requires no additional setup.
  • SSH key-based authentication: Best suited for servers demanding enhanced security or prohibiting password logins.

Requirements

  • Primary District Admin permissions
  • An existing SFTP export data source. For more information, see Configure an SFTP Integration.
  • A remote server that supports SSH key authentication

Set up password-based authentication

On the Delivery Config tab, enter the username and password provided by the remote server. No additional configuration is required. For more information, see Configure an SFTP Integration.

Set up key-based authentication

  1. Go to Connect > Home and select the SFTP export app.
  2. Go to Settings > Delivery Config.
  3. Click Use SSH Key Instead.
  4. Click Generate.
  5. Copy the displayed public key.
  6. Authorize your public key to the authorized_keys file on the remote server
  7. Click Test Connection to confirm the server accepts the key.

Note: SchoolDay generates a 2048-bit RSA key pair and securely stores the private key, which is never displayed. Only the public key is available to copy.

Verify the configuration

  • Test Connection returns a success message.
  • The next scheduled export run completes without an authentication error in sync history.

Regenerate a key pair

If the remote server requires a new key (e.g., following a security review), click Generate SSH key pair again. This replaces the stored key pair. Register the new public key on the remote server before the next export run, or the connection will fail.

Switch between authentication types

Switching from password-based to key-based authentication is permanent for that data source. Once a key is generated, you cannot revert the data source to password-based authentication.

If you need password-based authentication again, create a new SFTP export data source and configure it with a password.

Troubleshooting

Symptom

Cause

Fix

Test Connection fails after generating a key

The public key hasn't been added to the server's authorized_keys file yet

Copy the public key again and confirm the server owner has added it

Export runs fail with an authentication error

The key on the server doesn't match the current key in SchoolDay

Check whether the key was regenerated after the server was last updated; re-copy and re-register the current public key

Next steps