What is Obelisk?
Obelisk is a passkey-first identity and security plane. It's your one secure login across every product that uses it — no passwords, passkey sign-in is phishing-resistant, and you get a hash-chained record of sign-ins you can read. For businesses, it also measures and raises your security posture (the Obelisk Rating).
How do I create an account?
Start from your app's sign-in button and choose to create a passkey. Follow your device's passkey prompt and you're in — that is the whole sign-up. Invite-only deployments require an invitation link. Then add a second passkey on another device from your account page: it is the backup that gets you back in if you lose this one.
If the app requires a verified email, open the verification email in the same browser and confirm it. Return to the original sign-in tab and choose Continue to finish signing in to the app. Email verification proves control of the address; it does not replace your passkey.
What does “one login, everywhere” mean?
Obelisk is a single identity plane. The same account signs you in to every product built on it — one identity, no separate password per site.
What is a passkey?
A passkey is a modern replacement for a password. It's a cryptographic key stored on your device and unlocked with your face, fingerprint, or PIN. It is phishing-resistant: your device offers it only to the site it was made for, so a look-alike site can't collect it. There's no password to guess, and a database breach can't leak it, because the secret half is never sent to us or to the sites you sign in to: it stays on your device, or, for a synced passkey, is copied end-to-end encrypted between your own devices by your platform's password manager.
Do I still need a password?
No. Obelisk is passkey-first, and there's no password to manage. Your backup is a second passkey on another device. A sign-in link to your verified email gives you a limited session — enough to reach your account, not to add a passkey while you still have one registered.
How does one-tap sign-in work?
When a passkey for your account is available on the device you're using — created there, or synced to it by your password manager — your device offers it and one tap signs you in, with no username to type. Having signed in on a device before is not enough on its own: if no passkey is on that device, use a passkey from your phone or another nearby device instead.
Should I add a second passkey?
Yes — we strongly recommend it. A second, independent passkey (for example a hardware security key, or a passkey in a different password manager from your first) means losing one doesn't lock you out: sign in with the other, add a passkey for your new device, and remove the lost one. A passkey synced through iCloud Keychain or Google Password Manager is one passkey on many devices, not a second one. Add one from your account page right after signing in with a passkey. If you ticked “Keep me signed in”, or came in by email link or authenticator code, the account page asks you to confirm with your passkey first.
How do I add Face ID on my iPhone?
If your passkey is saved to iCloud Keychain, it is already on your iPhone: open obeliskgate.com in Safari and sign in with Face ID — there is nothing to add. If your passkey lives somewhere else (a security key, or a device outside your iCloud Keychain), sign in on the iPhone using it from a nearby device, which Safari offers, then go to Account → Add passkey and save a Face ID passkey; next time one tap signs you in. If you ticked “Keep me signed in” when you signed in, the account page asks you to confirm with your passkey once more before it adds one.
If your account has no passkey yet, use the email sign-in link: enter your email on the sign-in screen, tap the link on your iPhone, and add the Face ID passkey from your account. (An emailed link can add a first passkey, but not a second one while another is still registered.)
How do I sign in on a new device?
If your passkey syncs (iCloud Keychain, Google Password Manager and similar) and the new device uses the same account, the passkey is already there: just sign in. Otherwise, sign in with a passkey from your phone or another nearby device — most browsers offer this, often by scanning a QR code — then add a passkey for the new device from your account page, and next time will be one tap. If you ticked “Keep me signed in”, or came in by email link or authenticator code, the account page asks you to confirm with your passkey first.
I lost my device — what now?
If your passkey was synced (iCloud Keychain, Google Password Manager), it is not lost with the device: sign in to that account on your new device and the passkey is there. If you have a second passkey on another device, sign in with it, add a passkey for your new device, and remove the lost one from your account. That is the recovery that works on its own, and why a second passkey is worth setting up early.
An emailed sign-in link gives you a limited session: it reaches your account, but it cannot add a passkey while the lost one is still registered, so it does not finish a recovery by itself. Recovery codes are not accepted for sign-in on this Gate yet. If you have no other passkey, contact us: recovery beyond these paths is case by case and is not guaranteed.
What are recovery codes?
One-time backup codes, shown once when you generate them and stored by the Gate only as hashes. This Gate does not yet accept them for sign-in, so don't rely on them as your way back in — a second passkey on another device is.
I signed in from another site and Obelisk said it can't send me back. Why?
That site asked Obelisk to return you to an address it hasn't registered with the Gate. Obelisk only ever sends people back to destinations it knows — that is what stops a look-alike site from collecting your sign-in — so instead of quietly signing you in to the wrong place, it pauses and tells you. If you run the site, register its origin in the relying-party registry (see Integrate Obelisk); if you don't, tell the site's team. You can still sign in to your Obelisk account directly.
Can I sign in to a site without being sent to obeliskgate.com?
Yes, when the site has built for it. Three ways exist: a small Obelisk popup that hands the sign-in back to the page you're on; the browser's own account chooser (FedCM — you'll see an Obelisk prompt inline on the site, no redirect at all); and, on newer browsers, the passkey prompt right on the site's own page. Each only works for sites registered with Obelisk, and sign-ins through any of them go into the same hash-chained record of sign-ins you can read. If a site still sends you to obeliskgate.com, it is using the classic redirect flow — equally secure, one hop longer.
A passkey isn't working
A passkey works on the device that created it and on the devices your password manager has synced it to. Check that you're on one of those, and that your browser/OS is up to date. If a passkey was lost with a device, sign in with another passkey, remove the lost one from your account and add a new one. Still stuck with no other passkey? See I lost my device.
Can I add extra verification?
Yes. You can add an authenticator-app code (TOTP) as a fallback sign-in. It gives a limited session; changes to your credentials still need your passkey. Once it's set up, the Gate can also ask for a code as a second check after a passkey sign-in. A half-finished setup doesn't affect passkey sign-in.
What data does Obelisk store?
What it needs to run sign-in: your username and display name; your email, if you give one; your passkeys' public keys and credential IDs (never the private keys); your authenticator-app secret (encrypted) and recovery-code hashes, if you set them up; session and device records; and a hash-chained record of sign-ins and other account events. It lives in an encrypted database on our server, with daily encrypted backups to Cloudflare R2. Relying-party apps store their own data in their own databases — Obelisk doesn't hold your app data. The full list is in Privacy.
Can I export or delete my account?
Yes, both from your account page. Export my data downloads a copy of your account as a JSON file, without secrets. Delete my account removes your passkeys, turns off your authenticator code, signs out every session and erases your identity record; it asks you to confirm, and needs a session you signed in to with your passkey. The hash-chained audit records stay, as the Privacy policy describes. Export first: a deletion can't be undone from the web.
Is Obelisk free? What does it cost?
Obelisk charges per sign-in, not per user. Every account's first 10,000 sign-ins each month are free; above that, each sign-in has a small toll that falls as your volume grows. Token refreshes are free, and there are no tiers or feature gates. See pricing.
Who runs Obelisk?
Obelisk is provided by VaultSpark Studios LLC, as the Terms of Service say. To reach us, use the contact form.
What is the Obelisk Rating?
A single 0–100 score summarizing security posture, distilled from hundreds of live signal points — with a confidence weight and a trend. The Obelisk mark shows it: the ring's hue is your band and its lit segments are your coverage. More on the Rating.
How do organizations work?
Register an organization to get its own Obelisk Rating, invite a team under one roof, and manage members. Businesses can also scan a website to measure its posture. See plans.
How do I invite my team?
From your organization, send role-scoped invite links. Invites expire and are capped for safety. Members join with their own passkey-first Obelisk account — no shared passwords.
What's the organization Rating + website scan?
Your organization gets its own Rating, and you can run an external scan of a website (TLS, headers, and more) that rolls into a score with concrete levers to improve it.