BLACKBOX keys on your server

On every new VPS ordered on blackbox.md, the /root/.ssh/authorized_keys file contains, in addition to your own keys, two keys added by BLACKBOX: the management key and the AI agent key. You can see them in the app.blackbox.md panel, on the “My Servers” page (app.blackbox.md/my-servers, left menu “Infrastructure” → “My Servers”): on the server card, click “Add SSH key”, and the list appears in the “Installed keys” section.

Available to: the holder of the blackbox.md account that ordered the server. The key list does not appear on cards marked “Managed”; for those servers, write to us.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

The two keys at a glance

BLACKBOX keeps the private part of both keys, encrypted, together with the server's other access credentials. Neither key replaces your own: to connect yourself, use your own key or the root password.

How to recognize the keys

In the panel, each row in “Installed keys” shows the beginning of the fingerprint (for example SHA256:Ab12Cd34Ef56G…), the key type and the label: “Management key (blackbox.md)” for the management key, and the comment from the file for the others.

On the server, display the fingerprints of all the keys and compare them with the ones in the panel:

ssh-keygen -lf /root/.ssh/authorized_keys

The agent key's comment starts with blackbox-agent- and usually continues with the order number, for example blackbox-agent-bbx-2026-000123. The management key's comment is added automatically when the server is created; you can recognize this key by its fingerprint and its RSA type.

The management key

The panel uses this key to connect to the server over SSH, as root, every time you request an action that runs on the server:

• “Reset password”;
• the “Installed keys” list, “Add key” and “Remove”;
• “Disable password login” and “Enable password login”;
• the “Growing disk” step of an upgrade (Server upgrade: moving to a larger plan);
• commands run by an AI assistant (Running commands on the server through AI) and installing the agent key;
• installing the agent for the Monitoring add-on service (The Monitoring service: the agent installed on the server).

These actions do not need it: “Reveal credentials”, “Reboot”, “Stop”, “Start”, “Rename” and “Terminate”.

You cannot remove this key from the panel: its row has no “Remove” button, and an AI assistant that tries gets the error management_key_protected.

If you deleted it manually

The same errors also appear when the server is stopped or does not respond over SSH, so check that first. The panel cannot reinstall the key. Write to support with the order number (BBX-…) and the server's IP address, and we will restore it: How to contact BLACKBOX support.

Important Do not delete the management key from authorized_keys, and do not set PermitRootLogin no. Before you change the SSH or firewall settings, keep a second SSH session open. There is no web or VNC console for customers: if the panel can no longer reach the server and you also lose your own access, only support can help you (Lost access to your server (password or key)).

SSH settings that block the management key

The management connection logs in as root, with a key, on port 22.

Check the effective setting:

sshd -T | grep -i permitrootlogin

The results permitrootlogin yes, permitrootlogin prohibit-password and permitrootlogin without-password (the same setting under its old name) are fine. permitrootlogin no blocks the panel. If you want to work day to day as a user other than root, create that user, but keep root login with a key: Securing a new server: checklist.

The AI agent key

With this key, an AI assistant (Claude, Cursor, etc.) that you have allowed to do so can open a direct SSH session, for example for rsync or scp. The assistant receives the private part only when it requests it through MCP with the get_server_ssh_access tool, using a token with the “Vizualizează parolele/accesul serverelor” (View server passwords/access) permission (servers:credentials). Details: SSH access and SSH keys through the AI assistant.

• A server has a single agent key, shared by all your tokens.
• Commands run through AI with run_server_command do not use it: they go through the management key.
• Panel features do not depend on it.

How to remove the agent key

1. On the server card, click “Add SSH key”.
2. In “Installed keys”, find the row with the type ssh-ed25519 and the comment blackbox-agent-….
3. Click “Remove” and confirm the question “Remove key SHA256:… from this server?” (after “Remove key”, you see the beginning of the key's fingerprint).
4. The message “Key removed.” appears.

The key does not come back by itself. It is reinstalled only when an AI assistant with a token that has the servers:credentials permission requests SSH access to the server again, and then the same key comes back. The key changes only on a get_server_ssh_access request with regenerate=true: a new key is created, and the old one is deleted from the server.

Security The private part of the agent key gives root access, just like a password. If you suspect it has ended up in the wrong hands, revoke the tokens involved, remove the key in the panel and, if you still use SSH access through AI, request a new key with regenerate=true. Otherwise, the next request reinstalls the old key.

You stay in control

• An AI assistant can use the BLACKBOX keys only through an API token you created, and only with the permissions you checked when you created it: Token permissions (scopes).
• “Vizualizează parolele/accesul serverelor” (View server passwords/access) (servers:credentials) allows requesting the agent key, and “Rulează orice comandă ca root pe serverele mele” (Run any command as root on my servers) (servers:exec) allows commands through the management key. Both mean root access to all your servers.
• Revoke the tokens you don't use: blackbox.md → “Contul meu” (My account) → “Token-uri API” (API tokens) → “Revocă” (Revoke). The AI client loses access immediately: API tokens: creating, copying and revoking.
• Changing your blackbox.md account password stops all tokens created before the change.

Frequently asked questions

In “Installed keys” I see a key I did not add. What should I do? Identify it by its label and comment. “Management key (blackbox.md)” and the key with the comment blackbox-agent-… belong to BLACKBOX. If a key is neither yours nor one of these two, remove it with “Remove” and write to support: Your server was hacked or is under attack: what to do.

Can the BLACKBOX team access my server? The management key is used for the actions you request in the panel or through the AI assistant. We do not access or read the content of your application, except for technical support at your explicit request or when the law requires us to; in that case, unless the law forbids it, we inform you in advance (Data Processing Agreement (DPA) for companies). Every time the access credentials are shown, this is logged. For commands run through AI, we log only the fact that they ran, without the command text or its output.

I don't use AI assistants. Why is the agent key on my server? It is added to every new VPS so that an AI assistant can work without extra steps. Without a token with the servers:credentials permission, no one can request it from your account. You can remove it at any time; it comes back only with a new request for SSH access through AI. On a server that did not receive it at creation, it is created at the first such request.