* Deploy keys only grant access to a single repository. More complex projects may have many repositories to pull to the same server.

*The key hasfull read/write access tothe repository.

*Deploy keys always providefull read/write access toa repository.

* Deploy keys are usually not protected by a passphrase, making the key easily accessible if the server is compromised.

If your server needs to access multiple repositories, you can choose to attach an SSH keyto an automated user account.Since this account won't be used by a human, it's called a machine user. You can then[add the machineaccount as collaborator][collaborator] or[add the machine user to a team][team] with access to the repositories it needs to manipulate.

If your server needs to access multiple repositories, you can choose tocreate a new GitHub account andattach an SSH keythat will be used exclusively for automation.Since thisGitHubaccount won't be used by a human, it's called a machine user.You can then[add the machineuser as collaborator][collaborator] or[add the machine user to a team][team] with access to the repositories it needs to manipulate.**NOTE**: Adding a machine user as a collaborator always grants read/write access. Adding a machine user to a team grants the permissions of the team.

<divclass="alert">

<p>

<strong>Tip</strong>: Our <ahref="https://help.github.com/articles/github-terms-of-service">terms of service</a> do mention that <em>'Accounts registered by "bots" or other automated methods are not permitted.'</em> and that <em>'One person or legal entity may not maintain more than one free account.'</em> But don't fear, we won't send rabid lawyers out to hunt you down if youmake machine users for your server deploy scripts. Machine users are completely kosher.

<strong>Tip</strong>: Our <ahref="https://help.github.com/articles/github-terms-of-service">terms of service</a> do mention that <em>'Accounts registered by "bots" or other automated methods are not permitted.'</em> and that <em>'One person or legal entity may not maintain more than one free account.'</em> But don't fear, we won't send rabid lawyers out to hunt you down if youcreate machine users for your server deploy scripts. Machine users are completely kosher.

</p>

</div>

* Anyone with access to the repository and server has the ability to deploy the project.

* No (human) users need to change their local SSH settings.

* Multiple keys are not needed; one per server is adequate.

* Organizations can give read-only access to their machine users.

*By default, the key has full read/writeaccess tothe repository if the repository belongs to a user account. You can add themachineuser toaread-onlyteam if it's accessingrepositoriesin an organization.

*Only organizations haveaccess tocreate teams; therefore only organizations can use them to restrictmachineusers to read-onlyaccess. Personalrepositoriesalways grant collaborators read/write access.

* Machine user keys, like deploy keys, are usually not protected by a passphrase.