{"meta":{"title":"Adding a GPG key to your GitHub account","intro":"To configure your account on GitHub to use your new (or existing) GPG key, you'll also need to add the key to your account.","product":"Authentication","breadcrumbs":[{"href":"/en/authentication","title":"Authentication"},{"href":"/en/authentication/managing-commit-signature-verification","title":"Verify commit signatures"},{"href":"/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account","title":"Add a GPG key"}],"documentType":"article"},"body":"# Adding a GPG key to your GitHub account\n\nTo configure your account on GitHub to use your new (or existing) GPG key, you'll also need to add the key to your account.\n\n## About addition of GPG keys to your account\n\nTo sign commits associated with your account on GitHub, you can add a public GPG key to your personal account. Before you add a key, you should check for existing keys. If you don't find any existing keys, you can generate and copy a new key. For more information, see [Checking for existing GPG keys](/en/authentication/managing-commit-signature-verification/checking-for-existing-gpg-keys) and [Generating a new GPG key](/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key).\n\nYou can add multiple public keys to your account on GitHub. Commits signed by any of the corresponding private keys will show as verified. Once a commit has been verified, any commits signed by the corresponding private key will continue to show as verified, even if the public key is removed.\n\n\n\nTo verify as many of your commits as possible, you can add expired and revoked keys. If the key meets all other verification requirements, commits that were previously signed by any of the corresponding private keys will show as verified and indicate that their signing key is expired or revoked.\n\n### Supported GPG key algorithms\n\nGitHub supports several GPG key algorithms. If you try to add a key generated with an unsupported algorithm, you may encounter an error.\n\n* RSA\n* ElGamal\n* DSA\n* ECDH\n* ECDSA\n* EdDSA\n\nWhen verifying a signature, GitHub extracts the signature and attempts to parse its key ID. The key ID is then matched with keys added to GitHub. Until a matching GPG key is added to GitHub, it cannot verify your signatures.\n\n## Adding a GPG key\n\n1. In the upper-right corner of any page on GitHub, click your profile picture, then click ** Settings**.\n2. In the \"Access\" section of the sidebar, click ** SSH and GPG keys**.\n3. Next to the \"GPG keys\" header, click **New GPG key**.\n4. In the \"Title\" field, type a name for your GPG key.\n5. In the \"Key\" field, paste the GPG key you copied when you [generated your GPG key](/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key).\n6. Click **Add GPG key**.\n7. If prompted, authenticate to your GitHub account to confirm the action.\n\n## Further reading\n\n* [Checking for existing GPG keys](/en/authentication/managing-commit-signature-verification/checking-for-existing-gpg-keys)\n* [Generating a new GPG key](/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key)\n* [Telling Git about your signing key](/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key)\n* [Associating an email with your GPG key](/en/authentication/managing-commit-signature-verification/associating-an-email-with-your-gpg-key)\n* [Signing commits](/en/authentication/managing-commit-signature-verification/signing-commits)\n* [About commit signature verification](/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)"}