SSH "Permission denied (publickey)" with the right key: file permissions, agent forwarding, and the config that was never loaded

verbatim error$ ssh deploy@build.acme.io Permission denied (publickey). # verbose, the last lines: debug1: Offering public key: /Users/dev/.ssh/id_ed25519 RSA SHA256:... debug1: Server accepts key: ... debug1: sign_and_send_pubkey: signing failed for RSA ... debug1: No more authentication methods to try.

Problem

The correct key exists, ssh -i ~/.ssh/acme_deploy fails, and the same key works from a teammate's machine:

$ ssh deploy@build.acme.io
Permission denied (publickey).
# verbose, the last lines:
debug1: Offering public key: /Users/dev/.ssh/id_ed25519 RSA SHA256:...
debug1: Server accepts key: ... debug1: sign_and_send_pubkey: signing failed for RSA ...
debug1: No more authentication methods to try.

sign_and_send_pubkey: signing failed after the server accepts the key is the diagnostic: authentication died on the client side, before any password would have been tried.

Root cause

The server already approved the key — the client then refused to use it. Three client-side causes cover nearly every case:

1. Private key permissions too open: OpenSSH (since 7.4) refuses to read a private key that is group/world-readable: UNPROTECTED PRIVATE KEY FILE is in the full stderr you may have trimmed. 0644 keys are the single most common cause after a copy from a browser/download. 2. The key was not actually offered: -i sets an identity hint, but IdentitiesOnly and config ordering decide what gets tried — a default id_rsa being offered first, the right key never reached. 3. An encrypted key with no agent: passphrase prompts suppressed (cron, CI, IDE terminals) make signing fail silently.

fix preview — first 2 of 3 lines (bash), truncated:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/acme_deploy ~/.ssh/id_ed25519
… 1 more line in the fix

🔒 the fix — including 3 code blocks — is members-only. $1/mo unlocks everything.