> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kadoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SFTP

> Deliver data from completed runs to your SFTP server

Kadoa configures the destination for you through the [Support Center](/docs/support-center).

## Before you begin

Your SFTP server must support:

* Public internet access without a source-IP allowlist. Kadoa has no fixed SFTP IP address.
* Password or SSH private-key login.
* One of these host-key algorithms: `ssh-ed25519`, `ecdsa-sha2-nistp256`, `rsa-sha2-256`, or `rsa-sha2-512`.
* Renaming files within the base directory. Kadoa uploads each file with a `.part` suffix and renames it when the upload is complete. Kadoa uses `posix-rename@openssh.com` when the server offers it, and the standard SFTP rename otherwise.

If your server requires a source-IP allowlist, use [Amazon S3](/docs/destinations/amazon-s3) or [Google Cloud Storage](/docs/destinations/google-cloud-storage).

## Prepare the server

<Steps>
  <Step title="Create an account">
    Create a dedicated account on your SFTP server.
  </Step>

  <Step title="Create the base directory">
    Create a directory such as `/incoming/kadoa`.

    Use an absolute path as the SFTP account sees it. The path cannot be `/`.
  </Step>

  <Step title="Grant file access">
    Allow the account to create subdirectories and read, write, rename, and delete files within the base directory.
  </Step>

  <Step title="Get the server fingerprint">
    Get the host-key algorithm and SHA-256 fingerprint from your server administrator.

    For an OpenSSH server with an Ed25519 host key, run this command on the server:

    ```bash theme={null}
    ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
    ```

    Record the full fingerprint, including `SHA256:`. This example uses the `ssh-ed25519` algorithm.
  </Step>
</Steps>

<Warning>
  Confirm the fingerprint with your server administrator through a separate channel from the one used for the server address. Kadoa checks the fingerprint before authentication. If it does not match, Kadoa stops the connection.
</Warning>

## Add your credentials

A team Owner or Admin must create the [Secret Variables](/docs/workflows/secrets).
Never send passwords, private keys, or passphrases through email, chat, or a ticket.

In **Team settings**, open **Variables**. Choose one login method:

* **Password:** Store the password in a Secret Variable such as `SFTP_PASSWORD`.
* **SSH private key:** Authorize the matching public key for the SFTP account. Kadoa-managed secret fields support single-line values only. Store the private key in your Google Secret Manager project. Create a Secret Variable such as `SFTP_PRIVATE_KEY` that references it.

For an encrypted private key, store its passphrase in a separate Secret Variable such as `SFTP_KEY_PASSPHRASE`.

## Request the destination

Send these non-secret details through the [Support Center](/docs/support-center):

| Detail                                  | Example                               |
| --------------------------------------- | ------------------------------------- |
| Host                                    | `sftp.example.com`                    |
| Port                                    | `22`                                  |
| Username                                | `kadoa-delivery`                      |
| Authentication method                   | Password or SSH private key           |
| Credential variable                     | `SFTP_PASSWORD` or `SFTP_PRIVATE_KEY` |
| Passphrase variable, for encrypted keys | `SFTP_KEY_PASSPHRASE`                 |
| Host-key algorithm                      | `ssh-ed25519`                         |
| Host-key fingerprint                    | `SHA256:<43_CHARACTERS>`              |
| Base directory                          | `/incoming/kadoa`                     |
| Formats                                 | Parquet, JSONL, JSON, CSV             |
| Workflow health files                   | Off (default) or on                   |

## Verify the first delivery

After a workflow run completes, open the base directory in your SFTP client.

* Confirm that each selected format has one data file for the run.
* Ignore data files that end in `.part`. These files are incomplete and can remain after an interrupted delivery.
* Confirm that each data file's row count matches the same run in the dashboard.
* Run the workflow again. With the [default path template](/docs/destinations/data-destinations#file-layout-and-path-template), confirm that the new run has a new directory.

See [How data destinations work](/docs/destinations/data-destinations) for formats, file paths, and workflow health files.