Why we built it
Passwords were built for a web of humans typing into forms. That world is ending. Agents now act on our behalf, credentials are phished and stuffed at industrial scale, and "log in" has quietly become the softest part of almost every system.
We kept seeing the same pattern: teams pour effort into their product, then bolt on an auth layer that stores password hashes, MFA seeds, and reset tokens — a pile of secrets that becomes the single most attractive thing to steal. The weakest link wasn't the product. It was the front door.
So we set out to make the front door the strongest part of the building — and to make its strength verifiable, not just asserted.
The mark is the message
Look at the Obelisk above — the Living Fortress. An alien castle rises from the abyss, its fractured obelisk a monument to permanence; a living flame crowns it. An energized O-seal encircles the structure like a force field. That outer ring is full-circle security: in the live mark its hue follows the Gate's Obelisk Rating band and its lit segments show the Gate's live threat coverage.
Two fidelities, one idea. The immersive Living Fortress above is the hero surface — the full idea rendered. Everywhere else — your nav, your app icon, your favicon — the flat Obelisk Seal carries the same DNA in a crisp, minimal form: a parametric ring, a clean obelisk, a crowned pyramidion. One brand, right-sized for every context.
Our mission
Make identity the strongest part of your stack, not the weakest — and make that strength provable. Passkey-first by default, no passwords to steal and no user credentials in your app, sign-ins, tokens, grants and account changes recorded in a tamper-evident receipt, recovery that says plainly what gets you back in after a lost device, and a single live security score anyone can act on. We call it full-circle security.
What Obelisk does, and where to check it
Each row is something Obelisk does today, with the page where you can check it.
| What you get | Where to check |
|---|---|
| Passkey-first sign-in. Obelisk stores only your passkey's public key. | /security#boundary |
| Hash-chained receipts for sign-ins, tokens and grants | /proof |
| AI agents with identities of their own, each with an optional public, revocable Proof Link | /agents#identity |
| Sensitive changes need your passkey: a remembered, emailed-link or authenticator-code session can use your account but not change its credentials | /security#authn |
| Sign-in without leaving your page: a popup, FedCM, or the passkey on your own domain | /developers#in-place |
| A live Rating of our own Gate | /trust#rating |
| Recovery, stated plainly. A second passkey on another device gets you back in. An emailed sign-in link (to a verified address) or a code from an authenticator app you set up gives you a limited session, and a limited session cannot add a passkey to an account that already has one. Lost the only device with your passkey? A one-time recovery code created after signing in with a passkey, or an email recovery to your verified address that opens only after a 72-hour hold with a link to cancel it, lets you add a new passkey and nothing else. | /trust#never-lockout |
And one front door isn't just for your own app. Cloudflare, 1Password, and Microsoft Entra can use Obelisk as their OpenID Connect sign-in. Each ID token's obelisk.assurance claim says how the person signed in, so a tool that reads it can require a passkey. SAML apps such as GitHub, Google Workspace, AWS, Slack, and Atlassian can't be connected on the hosted Gate yet. See the connector list → Sites you don't even build on Obelisk can paste a live “Secured by Obelisk Gate” seal on their login page: served by obeliskgate.com, it shows its ✓ only on an address their registration names.
The throughline: security you can prove, not just promise. See the full trust case →
How we build
Proof over promises. Honest by construction. We don't invent cryptography: every signature, hash and cipher the service's code computes is a standard, published algorithm, run by Node.js's built-in crypto library or by two open-source libraries (@simplewebauthn/server checks passkey signatures, and xml-crypto handles SAML's XML signatures). That covers hash-chained receipts under an ES256-signed ledger head. A post-quantum (ML-DSA-65) signature sits beside it on the tree head; see the cryptography reference. Assurance is bound at the credential level — a passkey session and a code-only session carry different grants by construction. And a simple rule we hold ourselves to: if we can't measure it, we don't claim it.
Who makes Obelisk
Obelisk is built and operated by VaultSpark Studios — and it's the security foundation our own products stand on. We run Obelisk on Obelisk: the same passkeys and the same receipts we offer you. We ship it to ourselves first.
Get in touch
Prefer a form? Send us a message, or email us directly — General hello@obeliskgate.com · Security security@obeliskgate.com · Privacy privacy@obeliskgate.com · Legal legal@obeliskgate.com
Ready to build on it? Integrate Obelisk · Why trust it · Create your account.