Provable identity for the agent era
The login that can prove what happened.
Every sign-in, token, and agent action on Obelisk leaves a signed, hash-chained receipt with a public inclusion proof — an audit that physically can't be rewritten, checkable by you, your auditor, or your AI agent. Passkey-first for people, a standards-based MCP authorization & tool server for agents, one live security Rating over it all. Verify it yourself, right now — no account needed.
Passkey-firstMCP authorization serverHuman + agent identityOIDC + SAML IdPReceipt-backedNever-lockout
Public evidence
Measured trust, not marketing.
Current · as of 2026-09-15 22:55:30.319Z · aggregate only · counts below five are privacy-banded
Humans and agents
The same verifiable login — for people and for machines.
Incumbent identity was built for humans typing passwords. Obelisk was built for the moment your software started acting on its own: one plane that signs in a person and an autonomous agent with the same standards, the same receipts, and the same live Rating — never a bolt-on for either.
For people
Passkey-first, password-free
One-tap, phishing-resistant sign-in with nothing to type and nothing to leak.
- Usernameless WebAuthn — the credential never leaves the device
- Never-lockout guarantee with off-box recovery
- Assurance-bound sessions — power follows how you proved yourself
For agents & MCP
Identity, auth, and proof for autonomous software
Your agents and MCP servers delegate sign-in to Obelisk and verify the tokens it mints — and each agent can carry a live, inspectable identity of its own.
- OAuth 2.1 + PKCE with audience-bound tokens (RFC 8707)
- Agent Proof Links — owner-approved, key-proven, revocable public evidence
- Sender-bound (DPoP) tokens — a stolen bearer is inert
What it is
One plane for identity, trust, and proof.
Every project points at one login. Every access leaves a signed receipt. Every posture rolls up into one number you can act on. Obelisk is passkey-first, secret-free for relying parties, and built so you can never be locked out — the security layer a network of products can actually stand on.
Passkey-first login
Phishing-resistant WebAuthn by default. No passwords to steal, phish, or leak — the credential never leaves the device.
Sign in without leaving the page
Registered projects can keep people on their own page: a popup hand-back, the browser's native account chooser (FedCM), or the passkey prompt right on the project's origin. Each is fail-closed to registered origins — and each leaves the same signed receipt.
Agent Proof Links
Opted-in agents and bots carry an opaque, revocable proof link — independent live claims about key control, accountable ownership, workload evidence, and declared human influence. Never one gameable score, and never a claim the evidence can't back.
Sign in your agents & MCP servers
Obelisk is a standards-compliant MCP authorization server: agents and MCP servers delegate sign-in over OAuth 2.1 + PKCE with audience-bound tokens (RFC 8707), issuer-tagged responses (RFC 9207), and client-metadata-document identity — so autonomous tools authenticate the same verifiable way people do, with no client pre-registration.
Ask Obelisk over MCP
Any MCP-capable assistant can call Obelisk's read-only trust tools directly — scan a site's posture, verify a token, read an org's Rating, fetch an agent's proof — over JSON-RPC at /mcp. No account required.
Sender-bound tokens (DPoP)
Access tokens can be bound to the client's own key (RFC 9449): every call must carry a fresh on-device proof, so a stolen token without the private key is inert. Built for agent workloads, where bearer-token theft is the dominant threat.
One identity plane (OIDC + SAML)
A standards-compliant OpenID Connect provider AND a SAML 2.0 IdP — PKCE, JWKS, refresh-rotation, plus RSA-signed SAML assertions for legacy SPs. Every app points at one login; zero project-side secrets.
The Obelisk Rating
A single 0–100 security score from hundreds of live signals, with confidence and trend. Your logo literally renders it — hue is your band, lit segments are your coverage.
Tamper-evident receipts
Every login, token, grant, and access leaves a signed, chained receipt. Observe nothing without a trace — the audit can't be quietly rewritten.
Public inclusion proofs
Any receipt hash resolves to a Merkle inclusion proof against the published transparency head — so history can only extend, never be quietly rewritten. Verify it yourself; no account.
Shared Signals (CAEP)
Session revocations and credential changes propagate to your apps as signed Security Event Tokens (RFC 8417) — pushed to registered receivers, pollable by everyone else — so a revoked session dies everywhere, fast.
Never locked out — RTO ~15 min
A dual-store resilient backend, break-glass recovery, and encrypted offline backup — plus integrity-verified disaster-recovery backups taken off-box to Cloudflare R2 daily and a self-healing health watchdog. Lose the whole box and you're back in ~15 minutes; you cannot be locked out of your own keys.
The Obelisk Warden
A real-time risk engine that watches every login and action, scores it across 11 dimensions — device, location, velocity, blast radius, secret proximity — and decides: allow, step up, or deny. Adaptive security that judges every passage, never just watches.
Post-quantum migration-ready
Built for the quantum-resistant future — node-native crypto, no custom primitives, a documented PQC migration path baked into canon.
Be the IdP for your stack
One passkey-first front door for every tool your team uses. Federate Cloudflare, 1Password, and Microsoft Entra over OIDC, and GitHub, Google Workspace, AWS, Slack, Atlassian and more over the SAML 2.0 IdP — every sign-in inherits the same phishing resistance.
The verified seal embed
Drop a “Secured by Obelisk Gate” login card onto any site with one script tag. It's served live from obeliskgate.com, so it can't be forged, auto-updates itself, and shows the site's live Obelisk Rating.
Org & website scans
Bring a business or a website and get its own Obelisk Rating. Register an organization, invite a team, measure and raise your posture — live today.
The Obelisk Rating
Your logo is your security posture.
A single 0–100 score from hundreds of live signal points — never-lockout, database integrity, OIDC health, threat coverage, access control, and more — each with a confidence weight and a trend. The mark renders it: the ring's hue is your band, its lit segments are your coverage. The circle closes as you're protected.
Live: this Gate's own rating — drag to explore79Strong
Why it's trusted
Security you can verify, not just believe.
No passwordsPasskey-first — nothing to phish.
No project secretsRelying parties hold zero credentials; the macaroon is verified server-to-server.
Signed auditA tamper-evident receipt chain you can independently verify.
Multi-tenant isolationOne shared, encrypted identity plane — provably isolated per tenant.
For teams & businesses
Bring an organization. Measure your posture.
Register a business or a website and give it its own Obelisk Rating. Invite a team under one organization, manage members, and raise your score with concrete, prioritized levers. Dev-first and enterprise-ready — live today.
—
Try it now — a live TLS + security-header scan of any public site. Nothing stored.
One secure login. Everything you use.
Passkey-first, password-free, and trusted across every product. Your identity, protected by Obelisk.
Create your passkey →