Skip to content
Bayesian SSH

Set up Teams

bssh Teams shares connections with the people on your team. Each device keeps its own keys, the team’s connections are encrypted on your devices before they are synced, and the sync server stores only ciphertext and metadata. Set Teams up once per machine.

Teams needs a sync server. On the hosted service, the URL is in your invite if you were invited. If you create the team instead, the operator registers you and the URL comes with your onboarding. A self-hosted server’s URL comes from its operator.

Set up this machine

Section titled “Set up this machine”
bssh teams init --server https://teams.example.com --email you@example.com

bssh asks you to choose a passphrase, then creates your account and this device’s keys.

  • --invite <TOKEN> creates the account on a server that only accepts invited accounts. The token is in your invite.
  • --device-name <NAME> names this device for team admins. The default is the machine’s hostname.

The passphrase encrypts this device’s Teams keys. It never leaves the machine, nobody can reset it, and it needs at least 8 characters. If you forget it, the keys on this device stay locked; there is no recovery. An admin grants the team key to a new device instead.

Commands that use this device’s keys ask for the passphrase. In scripts, set BSSH_TEAMS_PASSPHRASE instead.

Check this device

Section titled “Check this device”
bssh teams whoami

It prints your account, the server, this device’s id and its fingerprint. The fingerprint identifies this device’s key to your team’s admins; you send it to them when they grant you a team key. In the desktop app, the same fingerprint is in the device panel at the top of Teams, with a Copy button.

Create a team

Section titled “Create a team”
bssh teams create platform

You become the team’s admin. The team is also a source in bssh list: its connections appear there like your own, with platform as their source.

Share a connection

Section titled “Share a connection”
bssh teams share db-prod --team platform

A shared connection carries its host, user, port, bastion (with its user), Kerberos setting and tags. It never carries key paths or passwords: each member connects with their own keys. Everyone in the team sees the connection after their next sync, and connecting to it is recorded in the team’s audit log.

On your machine, the team’s copy is listed as db-prod@platform next to your own db-prod.

Change a shared connection

Section titled “Change a shared connection”

Edit the team’s copy, then share it again before the next sync. A sync would otherwise restore the vault’s version:

bssh edit db-prod@platform --user deploy
bssh teams share db-prod@platform --team platform

In the desktop app, edit the host and choose Update in platform in its menu.

Remove a shared connection

Section titled “Remove a shared connection”
bssh teams unshare db-prod@platform

bssh asks for confirmation. The connection is deleted from the team vault for everyone, at their next sync; the server keeps its history. If the server cannot be reached, the removal is queued for the next sync. In the desktop app, open the team’s Hosts tab, choose Unshare next to the connection, then Remove for everyone.

Unlock and lock

Section titled “Unlock and lock”

On the command line, commands that use this device’s keys ask for the passphrase, or read BSSH_TEAMS_PASSPHRASE.

The desktop app asks for it the first time you open Teams after starting the app. The keys stay unlocked in memory until you choose Lock in the Teams header or quit. Team hosts still connect while Teams is locked; their session events are signed and uploaded at the next sync after you unlock.

Next steps

Section titled “Next steps”
© 2026 Bayesian SSHGitHubReport an issueClient released under the MIT license.