A Python CLI tool to easily switch between multiple Git SSH accounts. Manage multiple Git accounts with separate SSH keys and switch between them seamlessly.
- Manage multiple Git accounts with separate SSH keys
- Switch between accounts easily — one command, no fuss
- Generate SSH keys automatically (rsa, ed25519, ecdsa, and more)
- Optional passphrase support for SSH keys
- Opt-in SSH commit signing per account
- Colored terminal output with active account indicator
- Pre-commit hook to prevent commits with the wrong account
- Opt-in directory-based auto-switching (
gitacc rule) with a bash/zsh shell hook - Per-account SSH config
Hostaliases (gitacc alias) forgit@<alias>:org/repoclone URLs - Shell autocomplete for bash and zsh
- Cross-platform support (Linux / macOS)
pip install gitacc-switchergit clone https://github.com/ktechhub/gitacc_switcher.git
cd gitacc_switcher
pip install .# 1. Add your accounts
gitacc add # prompts for name, email, optional passphrase
gitacc add --type ed25519 # specify key type
# 2. Switch between them
gitacc switch work # full form
gitacc work # shorthand — same thing
gitacc switch work --local # only this repo, leave the global identity alone
# 3. See what's registered (active account is marked with *)
gitacc list
# 4. Prevent wrong-account commits in a repo
gitacc init work # sets expected account + installs pre-commit hook
gitacc verify # manual checkAdd a new Git account. Prompts for:
- Account identifier (used in key filename and as a reference)
- Git display name (defaults to account identifier)
- Optional SSH key passphrase
Available key types: rsa (default), ed25519, ecdsa, ecdsa-sk, ed25519-sk, dsa
gitacc add
gitacc add --type ed25519
gitacc add --sign # opt in to SSH commit signing for this accountPass --sign to opt this account into SSH commit signing. When you later gitacc switch to it,
user.signingkey is set to the account's public key and gpg.format=ssh / commit.gpgsign=true
are enabled (locally too, with --local), so every commit made under this identity is signed.
Switching to an account without --sign clears any signing config left by a previous account.
Toggle it later with gitacc update <account> --sign / --no-sign.
Switch to a registered account. Clears all keys from the SSH agent, loads only this account's key, and sets git config --global user.name/email.
gitacc switch mywork
gitacc mywork # shorthandPass --local/-l to set the identity for the current repository only (git config local scope), leaving the global user.name/user.email untouched. Must be run from inside a Git repository.
gitacc switch mywork --localThe SSH agent must already be running (
eval $(ssh-agent)). If it isn't, gitacc will tell you.
List all registered accounts. The currently active account (matching global git config) is marked with *.
gitacc list
# Registered accounts:
# * work → Git name: Jane Doe (jane@company.com) (active)
# - personal (jane@personal.com)Remove an account and its SSH keys. Prompts for confirmation.
gitacc remove mywork
gitacc remove # prompts for account nameUpdate the Git display name and/or email for an existing account. Prompts for any field not provided as a flag.
gitacc update mywork --name "Jane Doe"
gitacc update mywork --email "jane@newcompany.com"
gitacc update mywork # prompts for both
gitacc update mywork --sign # enable SSH commit signing for this account
gitacc update mywork --no-sign # disable itBind the current repository to an account and install a pre-commit hook. Any commit attempt with a mismatched account will be blocked.
cd ~/projects/work-repo
gitacc init myworkCheck whether the current Git identity matches the account expected by this repository.
gitacc verifyKill the SSH agent and unset the global Git user config.
gitacc logoutOpt-in, direnv-style directory-based auto-switching: bind an account to a directory (and
everything beneath it) so the right identity is picked automatically as you move around, instead
of running gitacc switch by hand. directory defaults to the current directory. The most
specific matching directory wins, so a rule on a subdirectory overrides one on its parent.
gitacc rule add work ~/projects/work # anything under ~/projects/work uses "work"
gitacc rule add personal ~/projects/side # anything under ~/projects/side uses "personal"
gitacc rule list
gitacc rule remove ~/projects/sideRules by themselves don't do anything — nothing triggers on cd until you install the shell hook
below.
Print a shell snippet that calls gitacc rule check so rules apply automatically. Add it to your
shell profile and restart your shell (or source it):
# bash
gitacc rule hook bash >> ~/.bashrc
# zsh
gitacc rule hook zsh >> ~/.zshrcThe hook is silent unless it actually needs to switch accounts: no matching rule, an SSH agent
that isn't running, or an identity that's already correct all do nothing. This is entirely
opt-in — gitacc rule add alone never touches your shell config.
gitacc alias add <account> <host-alias> [--hostname HOSTNAME] [--user USER] / gitacc alias remove <host-alias> / gitacc alias list
Bind an SSH config Host alias to an account's key by writing a clearly delimited, safely
add/updatable/removable block to ~/.ssh/config. This lets you clone/push via a per-account host
alias (e.g. git@github-work:org/repo) without hand-editing your SSH config, and without the
account's key needing to be loaded into the SSH agent at all.
gitacc alias add work github-work # git@github-work:org/repo uses "work"'s key
gitacc alias add personal github-personal --hostname github.com
gitacc alias list
gitacc alias remove github-work--hostname defaults to github.com and --user defaults to git. Running alias add again
for the same alias updates it in place; everything else already in ~/.ssh/config (including
aliases for other accounts) is left untouched.
# clone using the "work" account's key, without ever switching the active identity
git clone git@github-work:myorg/myrepo.gitInstall tab-completion for your shell (bash or zsh). After running, restart your shell or source your profile.
gitacc autocomplete installCompletions cover: all command names, account names (for switch, remove, init, update), and key types (for add --type).
gitacc --version
# gitacc 0.1.0gitacc init myworkstoresgitacc.expected-account = myworkin the repo's local git config and writes a pre-commit hook.- On every
git commit, the hook reads~/.gitaccand compares the expected account's name/email against the currentgit config user.*. - If they don't match, the commit is blocked with a helpful message pointing to
gitacc switch.
| Path | Purpose |
|---|---|
~/.gitacc |
Stores all account entries (INI format) |
~/.gitaccrules |
Directory → account rules for gitacc rule (opt-in auto-switch) |
~/.ssh/id_<type>_<account> |
Private SSH key per account |
~/.ssh/id_<type>_<account>.pub |
Public SSH key per account |
~/.ssh/config |
Holds gitacc-managed Host alias blocks (gitacc alias), clearly delimited from any other entries |
~/.gitacc format:
[mywork]
name = Jane Doe
email = jane@company.com
private_key = /home/jane/.ssh/id_ed25519_mywork
public_key = /home/jane/.ssh/id_ed25519_mywork.pub
sign = false~/.gitaccrules format (one rule per line, most-specific directory wins):
/home/jane/projects/work = work
/home/jane/projects/work/client-a = client-a
- Python 3.8+
- Git
- SSH tools (
ssh-keygen,ssh-agent,ssh-add) inPATH
See CHANGELOG.md for a full history of changes.
Versions and the changelog are generated automatically by Release Please from Conventional Commit PR titles on main — feat: bumps minor, everything else bumps patch, and ! after the type (e.g. feat!:) bumps major. See CONTRIBUTING.md for the full commit/branch convention.
See CONTRIBUTING.md for setup instructions, commit conventions, and the PR process.
MIT — see LICENSE for details.