Create the organization under a verified Obelisk identity.
One login, many organizations, many sites
Your single passkey-first Obelisk identity is the root. From it you can create or join many organizations, and each organization can hold many projects and websites — so one person can run an entire portfolio of teams and sites without a second password anywhere. Membership is mirrored onto your identity record, so moving between organizations is never a fresh login.
| Layer | What it is |
|---|---|
| Identity | One passkey-first account — the root of everything below |
| Organization | A team boundary you own or join, with owner / admin / member roles |
| Projects & sites | The apps and websites an organization registers — each earns its own Obelisk Rating |
Manage many orgs, each with many sites, under one login. A studio, an agency, or a parent company can hold every team it operates as separate organizations, keep their members and posture walled off from one another by tenant isolation, and still administer them all from the same account.
Register your own apps
Bringing your own application to Obelisk needn't wait on a support ticket. Two paths are live today. No registration at all (recommended): Obelisk resolves an https client_id Metadata Document (CIMD, the DCR successor) at authorize time, so a relying party that hosts a small metadata file signs in with zero pre-registration — SSRF-guarded and scoped to your own tenant. Account app registration: signed into your Obelisk account, register a relying party and receive a working client_id — public browser/edge clients hold no secret, confidential server clients get one — isolated from every other tenant by construction. The full flow and token verification live in the developer guide.
Anonymous OIDC Dynamic Client Registration (RFC 7591) is operator-gated and enabled per deployment; CIMD covers the same need without pre-registration. Rolling out: per-organization SSO policy is switched on organization by organization; where a piece isn't yet enabled for you, talk to us. Declared intent and live capability stay separate here, so nothing reads as done before it is.
Walk the organization trust runway
Move the planning control to see which evidence exists at each stage. This is an onboarding preview—not your live Obelisk Rating.
Identity anchoredFounder passkey + organization receipt
Issue role-scoped, revocable invitations with a receipt trail.
Attach a website and turn concrete controls into an Obelisk Rating.
Re-scan after changes and compare evidence, not optimism.
Roles are capabilities, not labels
| Role | Boundary | Proof |
|---|---|---|
| Owner | Organization lifecycle, invitations, and scans | Session + owner authorization + mutation receipt |
| Admin | Team operations delegated by the owner | Role-scoped membership and receipt history |
| Member | Read and participate inside the organization | Accepted, non-revoked invitation chain |
A Rating with levers
The organization scan evaluates observable public controls and returns concrete levers. It does not certify private systems it cannot measure, and missing evidence never reads as green.
Human + agent parity. Humans use the organization dashboard; agents discover the same endpoint/auth contract through /api?format=json.
Start with one passkey
Create or sign in to your Obelisk account
After sign-in, create the organization from your account hub. Need an architecture review first? Talk to us.
Building on top of it? Integrate Obelisk with the official SDK, connect agents through the MCP trust flight, or read the whole surface in the API reference.