SSH access for the agents you run.
Register the servers your agents need to reach. Gateway issues each one its own SSH identity, so every agent gets exactly the access it needs instead of a credential everyone shares.
What your agent gets when you add a server
Its own SSH identity
The moment you register a server, Gateway generates a dedicated Ed25519 keypair for it and encrypts the private half before anything else touches it. You install the public half once.
Access scoped to that server
An agent's access to one server never doubles as access to another. Rotate or revoke a single identity without touching anything else you've connected.
A record of what it did
Every sign-in, credential change, and file pulled off a server is logged, scoped to your account, so you can see exactly what an agent did and when.
The part we didn't build yet, on purpose
Gateway doesn't open the SSH connection your agent uses, run its commands, or check whether a server is actually reachable. That's the execution layer: a separate, harder problem, being solved on its own timeline instead of bolted on early to make a demo look finished. Get the credential and audit layer right first. See known limitations for the current, unvarnished list.
No Gateway password. Ever.
Sign-in runs entirely through your OAuth2 or OIDC provider. Gateway never asks for a password, so there is never one on file to leak, phish, or reset.
Sign in