diff --git a/client.go b/client.go
index 733f242..1ea2b3c 100644
--- a/client.go
+++ b/client.go
@@ -18,6 +18,7 @@ import (
 	"github.com/fangdingjun/go-log/v5"
 	socks "github.com/fangdingjun/socks-go"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 )
 
 // Client is ssh client connection
@@ -29,6 +30,7 @@ type Client struct {
 	err       error
 	ctx       context.Context
 	cancel    context.CancelFunc
+	authAgent agent.ExtendedAgent
 }
 
 // NewClient create a new ssh Client
@@ -54,6 +56,11 @@ func NewClient(c net.Conn, config *ssh.ClientConfig, addr string, conf *Conf) (*
 	return client, nil
 }
 
+// SetAuthAgent set auth agent
+func (cc *Client) SetAuthAgent(_agent agent.ExtendedAgent) {
+	cc.authAgent = _agent
+}
+
 // Client return *ssh.Client
 func (cc *Client) Client() *ssh.Client {
 	return cc.client
@@ -168,6 +175,17 @@ func (cc *Client) Shell() error {
 		return err
 	}
 
+	if cc.authAgent != nil {
+		log.Debugln("request auth agent forwarding")
+		if err = agent.RequestAgentForwarding(session); err == nil {
+			if err1 := agent.ForwardToAgent(cc.client, cc.authAgent); err1 != nil {
+				log.Debugln(err)
+			}
+		} else {
+			log.Debugln(err)
+		}
+	}
+
 	// register console change signal
 	consoleChange(_console, session)
 
diff --git a/obfssh/ssh.go b/obfssh/ssh.go
index a3002f3..261ac08 100644
--- a/obfssh/ssh.go
+++ b/obfssh/ssh.go
@@ -86,6 +86,7 @@ func main() {
 
 	var agentConn net.Conn
 	var err error
+	var agentClient agent.ExtendedAgent
 
 	// read ssh agent and default auth key
 	if cfg.Password == "" && cfg.PrivateKey == "" {
@@ -115,7 +116,7 @@ func main() {
 		if err == nil {
 			defer agentConn.Close()
 			log.Debugf("add auth method with agent %s", os.Getenv("SSH_AUTH_SOCK"))
-			agentClient := agent.NewClient(agentConn)
+			agentClient = agent.NewClient(agentConn)
 			//auth = append(auth, ssh.PublicKeysCallback(agentClient.Signers))
 			signers, err := agentClient.Signers()
 			if err == nil {
@@ -268,6 +269,10 @@ func main() {
 
 	log.Debugf("ssh negotation success")
 
+	if agentClient != nil {
+		client.SetAuthAgent(agentClient)
+	}
+
 	var local, remote string
 
 	// process port forward