diff --git a/plugins/ssh-keys/user-auth b/plugins/ssh-keys/user-auth
new file mode 100755
index 000000000..b07a09d9b
--- /dev/null
+++ b/plugins/ssh-keys/user-auth
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+
+check_ssh_keys_user() {
+  declare desc="check user running ssh-keys"
+  local SSH_USER=$1 SSH_NAME=$2
+  [[ "$SSH_USER" != "root" && "$SSH_NAME" != *admin* ]] && dokku_log_fail "You must be root, or a dokku admin, to execute this command" || true
+}
+
+[[ "$3" == ssh-keys* ]] && check_ssh_keys_user "$@" || true