This is a known feature we want to build but don't currently support.

There is a workaround but it is slightly annoying:

1. Create opk ssh key pair on a machine that has a browser,
2. Copy key pair to ~/.ssh on remote linux machine (doesn't have a browser)
3. SSH from remote linux machine

Another possible workaround is to use opkssh with lynx (CLI text-based browser). I haven't tested it but it might work.
1 sudo apt install lynx
2. Open two terminals
3. In terminal one: run opkssh login google --disable-browser-op It should output Open your browser to: http://localhost:3000/login
4. In terminal two: run lynx http://localhost:3000/login Accept all the cookies and sign into Google. Once Google signin completes you should see that terminal one has created your opk ssh key
5. Now ssh as normal

Tried it, it doesn't work for lynx doesn't support javascript when I run it with my microsoft account. In fact not only lynx, most of text based browser doesn't support it. maybe someone can compile a javascript support text based browser, but it seems not very easy.
One more thing, what if my account been stolen by a hacker(I means hacker stolen my cookie, that means he doesn't need to login with password or 2FA). Does it means as long as i used this account, hacker will always ssh my machine until cookie expired? In which hacker can bypass the time limit configure by server side. Of course, this can be avoided by incognito mode.

More specifically, is there an option to generate one-time use token? I noticed that sometimes i just need ssh one time temporarily in just a short time(like Disposable syringe). After that I don't want anyone include myself to login again except using opkssh login in incognito mode again.

Thanks for testing it.

One more thing, what if my account been stolen by a hacker(I means hacker stolen my cookie, that means he doesn't need to login with password or 2FA).

If the hacker can complete the auth flow as you, then yes they can issue an opk ssh key to themselves much like they can read your email or anything else you use that account for. That said, most IDPs try to detect and automatically revoke compromised sessions and will let you manually revoke a session.

OpenPubkey supports adding 2FA to the authentication process, a.k.a. the MFA cosigner. This means that even if the IDP is compromised you are still safe. It would also protect against a stolen cookie. Opkssh doesn't currently have support for the MFA cosigner, but it is on the roadmap.
https://github.com/openpubkey/openpubkey/

More specifically, is there an option to generate one-time use token? I noticed that sometimes i just need ssh one time temporarily in just a short time(like Disposable syringe). After that I don't want anyone include myself to login again except using opkssh login in incognito mode again.

That's a neat idea, there is no current option for this. Create an issue and describe the requirement and feature and I'll look into it.

In short, is it possible to generate one time ssh key that just can be used with ssh user@ipaddress one time. After I used exit or close the ssh connection, I must opkssh login again to get a new token.
it seems like i login in microsoft on a public computer with incognito mode browser to do some work. After I close the browser, if I want to do some work again, I have to sign in microsoft with password or 2FA.
because I don't know how MFA works, maybe it can be achived with MFA.

This ideal is inspired by termius.
Termius works like this,

1. generate a ssh key pair whose private key is protected by touch id or face id;
2. copy public key to server you want to ssh; (this is needless for opkssh)
3. ssh the server and it will pop up a windows to verify your touch id or face id;
4. if the touch id or face id is correct, ssh connection will establish, else exit.

For there is no IDP in the above case, which makes the connection more simple and secure.

For opkssh it use pubkey not ID, so maybe it can be implement with the same method.
That's means when user opkssh login, they should verified two times, the first time is login in microsoft and the other is use touch id or face. While user want ssh user@ipaddress, what they need to do is just use touch id or face id.
This maybe a different technical route compared with MFA. As I didn't look deeply into openid connect protocol, i don't know the provable security of this method.

The core ideal is that use a specific mthod to encrypt private key stored in .ssh.

Thanks for providing more details this is an interesting usecase.

In short, is it possible to generate one time ssh key that just can be used with ssh user@ipaddress one time. After I used exit or close the ssh connection, I must opkssh login again to get a new token.

Are two ways to do this today but they require some ssh configuration hijinks.

• Use write a shell script that calls opkssh login and than ssh and deletes the private key immediately after ssh is called.

• If you wanted to ensure the ssh private key never hits the filesystem you could use [process substitution] (https://en.wikipedia.org/wiki/Process_substitution) and Command substitution with the opkssh --private-key-file to send the key directly from opkssh to ssh without touching the filesystem. I haven't tested this myself and likely requires some additional shell trickery.

• Both the above approaches should be done using ssh ProxyCommand to call the script which runs opkssh login and ssh.

In terms of future features, one could add an opkssh ssh user@hostname subcommand that would automatically call SSH it the private key directly. I don't have time to add such a feature in May, but would it solve your issue. This idea has been proposed before and there is a ticket for it: #72