On a Mac, open Terminal and run ssh-add -l. This lists the fingerprints and comments for identities available through the SSH agent connected to that Terminal session; it does not print private key material. If the agent has no identities, the command reports that. Treat this as a check of the current agent connection, not a complete inventory of keys stored on your Mac.

List the identities in the current agent

In Terminal, enter:

ssh-add -l

The -l option lists fingerprints of identities represented by the agent. OpenSSH’s default fingerprint format is SHA-256. Each result typically includes a key size, fingerprint, key comment, and algorithm; the comment may help identify the key, but it is user-supplied text and is not proof of which account or server will accept it. OpenSSH ssh-add(1) manual

This command only requests a listing. It does not add or remove identities. Avoid ssh-add -D and ssh-add -d while checking: those options remove identities. Also avoid ssh-add -L if your goal is to reveal as little as possible. That option prints the public key parameters for identities in the agent. A public key is not a private key, but it is more identifying information than a fingerprint. OpenSSH ssh-add(1) manual

Understand an empty list or connection error

If the output says the agent has no identities, the agent reached by this Terminal has none to report. That does not establish that you have no SSH keys on disk, in a hardware authenticator, or elsewhere. Nor does it prove that another app or Terminal window uses the same agent. OpenSSH relies on the SSH_AUTH_SOCK environment variable to locate the agent, so separate sessions can be connected differently. OpenSSH ssh-add(1) manual

If instead you see an error such as “Could not open a connection to your authentication agent,” the current shell could not query the agent socket. The listing has not established whether another session has identities. Re-run ssh-add -l in the Terminal or shell you use for SSH; do not start a new agent just to check, because that may give this shell a different, empty agent. If the command still fails, check whether the environment is configured to provide SSH_AUTH_SOCK with printf '%s\n' "$SSH_AUTH_SOCK". This displays the socket path, not a key, but it does not itself verify that the socket is usable.

Distinguish the agent from macOS Keychain

An SSH identity loaded in an agent and a passphrase stored in Keychain are different things. Apple documents UseKeychain as an SSH configuration option for storing a key’s passphrase, and AddKeysToAgent as an option that loads a key into the agent when SSH uses it. Thus, a passphrase in Keychain does not by itself mean the identity currently appears in ssh-add -l; an identity may be added to the agent later, such as during an SSH connection. Apple Technical Note TN2449

If you need to inspect Keychain items, Keychain Access can show information about keys and certificates stored in a selected keychain. That is a separate inspection from listing the active agent, and it should not be used to infer which identities this Terminal can currently offer. Apple Support: View the information stored in a keychain on Mac

What this check can tell you

Use ssh-add -l when you need a low-disclosure snapshot of the identities available to the agent for this Terminal session. Compare the fingerprint with a trusted record if you need to recognize a particular key. The listing does not show private key contents, identify every key on the computer, confirm that a remote server authorizes a key, or guarantee that a later SSH command will use a listed identity; SSH configuration and connection context also affect authentication.

Sources