restic backup to SFTP failed "unable to connect: permission denied (publickey)"

Not specified by the original author.

TL;DR

Permission denied publickey means the SFTP server refused the key the restic process offers: confirm which key file the backup's user context loads, that the matching public key is in the server account's authorised keys, and that file permissions on the key and the server-side file satisfy the SSH server's strict checks. Test the exact connection with a plain SFTP login using the same user, host, and key before involving restic.

restic backup to SFTP failed "unable to connect: permission denied (publickey)"

Use this when

• The job or restore fails with this symptom: restic backup to SFTP failed with unable to connect: permission denied (publickey).
• You are working on a restic backup writing to an SFTP backend and the failure repeats on the same target or schedule.
• You need the failing job, stage, or component isolated before changing retention or infrastructure.

Not for this skill when

• A server that disabled public key authentication in favour of another method, where the fix is the server's auth configuration.
• The error text names a different product, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce the connection with a verbose SFTP or SSH attempt using the backup job's user, host, and key file. Verify: the offered key and the server's response are visible
2. Compare the offered key's fingerprint with the public keys authorised on the server account. Verify: key pairing is confirmed or found mismatched
3. Check permissions: the private key readable only by its owner, and the server-side authorised keys file owned and writable only by its account. Verify: permission causes are cleared
4. Run the restic backup again and confirm snapshots begin landing in the repository. Verify: the backup connects and writes

Variant phrasings

restic sftp unable to connect permission denied publickey

The verbatim phrasing.

restic backup sftp publickey denied key authorised fix

The key phrasing.

restic sftp backend authentication failed verbose ssh

The verbose phrasing.

Compatibility: restic backups over SFTP with public key authentication

Why it happens

SFTP key authentication fails in identical words for a wrong key, an unauthorised key, and permission problems at either end, because the server deliberately reveals little. The verbose client output and the fingerprint comparison are what turn the generic refusal into a named cause.

Edge cases / pitfalls

• Scheduled jobs run as a different user with a different home and key set than the interactive setup; always test as the job's user.
• A rotated server host key produces a different error, but in some wrappers it is folded into this one; check host key verification too.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_67kcN53vIGGhGoVVlbAepw

Resolved from the public thread: https://vectle.com/posts/pst_67kcN53vIGGhGoVVlbAepw

Thread query: restic backup to SFTP failed "unable to connect: permission denied (publickey)"

TL;DR: Permission denied publickey means the SFTP server refused the key the restic process offers: confirm which key file the backup's user context loads, that the matching public key is in the server account's authorised keys, and that file permissions on the key and the server-side file satisfy the SSH server's strict checks. Test the exact connection with a plain SFTP login using the same user, host, and key before involving restic.