> ## Documentation Index
> Fetch the complete documentation index at: https://docs.murmur.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# murmur setup signing

> Configure agent commit signing independently, or keep and re-run an existing signing setup.

Configures commit signing for your agents with `murmur setup signing`. It uploads the signing key to your developer profile on the server, so every agent you start, from the CLI, MCP, or the dashboard, signs with it. It reuses your Murmur sign-in and offers sign-in when needed. Other credentials, Git author settings, and server-access SSH keys are preserved.

## Synopsis

```bash theme={null}
murmur setup signing
```

This command takes no positional arguments or configuration flags. Use `--help` for usage.

## Keep or re-run

When your Murmur profile already holds a signing key, the command offers this choice:

| Choice | Behavior |
| - | - |
| **Keep it (recommended)** | The default. Leaves the key on your profile untouched. Does not look up or register a signing key on GitHub or generate a key. |
| **Re-run signing setup** | Loads or generates the dedicated key, checks GitHub registration, and uploads the private key securely to your Murmur profile. |

When your profile holds no signing key, the command proceeds with signing setup.

## What setup does

1. Resolves the GitHub account used for signing registration. The standalone command checks `MURMUR_GH_PAT`, `GH_TOKEN`, then `GITHUB_TOKEN`; otherwise it uses your `gh` CLI login. The `gh` CLI must be installed for registration, including when you supply a token.
2. Reuses `~/.ssh/murmur_signing_key_<github-user>`, or generates a dedicated Ed25519 key. It does not select an SSH key you use to access servers. **Re-run does not mean rotate:** an existing dedicated key is reused.
3. Checks whether GitHub already has that public key. A confirmed registration skips another upload and, on the `gh` login path, skips browser reauthorization. If registration cannot be confirmed, the `gh` path requests the signing-key permission before attempting registration. A supplied PAT must already have the [required permission](https://docs.murmur.dev/security/github-pat.md).
4. Uploads the private signing key securely to Murmur and updates your developer profile's signing-key reference.

The registration token is used only for registration: it is never stored and does not replace the GitHub token on your profile. The signing account can differ from the account agents use to push commits.

## What re-running verifies

The message `Signing key already registered on GitHub` means the public key was found on GitHub. Setup still performs the Murmur upload and profile update afterward.

A successful run confirms those configuration operations completed. It does **not** start an agent, sign a test commit, or check that GitHub marks a commit **Verified**. To check signing end to end, inspect a commit produced by an agent using the configured profile.

## Errors and recovery

GitHub registration failures stop setup. If a PAT lacks signing-key permission, grant that permission and re-run setup.

The steps commit separately. A later failure can leave an earlier GitHub registration or Murmur upload completed. Correct the reported error and re-run; setup reuses the dedicated key when available and checks its GitHub registration again. Keeping the profile's key leaves it untouched and does not repair or verify it.

## Related

* [`murmur setup`](https://docs.murmur.dev/cli/setup): list configuration subcommands
* [`murmur setup forge`](https://docs.murmur.dev/cli/setup-forge): configure the credentials agents use for GitHub access
* [Commit signing and encryption](https://docs.murmur.dev/security/encryption.md#commit-signing)
* [GitHub PAT permissions](https://docs.murmur.dev/security/github-pat.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.