Nokku LogoNokku
Early preview. Cloud is in development, self-hosted access comes first.Join the waitlist
Early preview · waitlist open

authorized_keys
is dead.
Long live certificates.

Nokku replaces scattered static keys with SSO-backed, short-lived SSH certificates. Connect with plain ssh, record every session, and sail through your next audit. Engineered and hosted in the EU.

Join the waitlistRead the docs
  • ▪ephemeral certs
  • ▪zero keys
  • ▪session replay
  • ▪EU hosted
1❯
SSH CertificateValid
type
ssh-ed25519-cert-v01
identity
alice@acme.com
principals
root, ubuntu
valid
14:00 18:00 UTC
via
Okta SSO
expires automatically · nothing to revoke

How it works

Signup to first ssh in minutes.

No bastion to babysit, no key-distribution ritual. Certificates do the work.

01create workspace

Sign up, get a CA

Your workspace and its SSH certificate authority are created for you. That's the entire infrastructure to run.

02enroll servers

Connect your fleet

One line installs the nokku daemon: embedded SSH server, host certs, principal sync. Prefer manual? TrustedUserCAKeys works too.

03assign access

Map people to principals

SSO groups become Linux principals per target. With expiry built in.

04ssh

Your engineers just ssh

One SSO login, then plain OpenSSH like always. Certificates are issued and expire invisibly in the background.

The problem

Static keys are a liability. Certificates are the fix.

~/.ssh/authorized_keys · prod-db-01
ssh-rsa AAAAB3…x9q alice@old-laptopleft the team in 2024
ssh-rsa AAAAB3…77f temp-contractorstill active
ssh-ed25519 AAAAC3…k1p bob@workstationno expiry
ssh-rsa AAAAB3…m2w deploy@ci-runner-04unknown owner
ssh-rsa AAAAB3…q0a root@jumphost-oldforgotten
… 42 more lines
47 keys · 0 expiry dates · 0 audit records
Static keys pile up silently. Nobody knows who can access what, until the auditor asks.
workspace: acme · access assignments
identityprincipaltargetexpires
alice@acme.comrootprod-db-013h 12m
team: sreubuntuprod-*renews via SSO
ci-deploy (service)ubuntustaging-021h
3 assignments · all expiring · 100% recorded
Access is an assignment with an expiry, not a file on a disk.

Capabilities

Everything the fleet needs. Nothing it doesn't.

Built in Go. One control plane for all your infrastructure access, without the enterprise complexity.

Certificate-Based Auth

Eliminate authorized_keys forever. Every connection uses an auto-generated, short-lived OpenSSH certificate signed by your workspace CA. Keys expire; access is always fresh.

SSO & Identity Native

Okta, Google Workspace, or Azure AD via OIDC and SAML 2.0. Your identity provider becomes the source of truth.

Session Recording

Interactive sessions are recorded and replayable for compliance, auditing, or incident investigation.

replay #8412 · prod-db-0115:02 / 42:17

Daemon or Manual

Install the lightweight Go daemon for zero-config auto-discovery, or configure native OpenSSH with TrustedUserCAKeys yourself. Your call; both are first-class.

two ways in · both first-class
daemoncurl -fsSL get.nokku.sh/nokkud | sh
manualTrustedUserCAKeys /etc/ssh/nokku_ca.pub

Granular RBAC

Map SSO groups to Linux principals on specific targets. Marketing gets ubuntu on staging. SREs get root on prod. Automatically.

Passkey & WebAuthn

Hardware-backed authentication keeps your control plane immune to phishing. FIDO2-compliant, no SMS codes.

Self-Hosted & Air-Gapped

Run the whole control plane inside your own network. Enterprise license keys verify offline, so access keeps working in air-gapped or isolated environments.

For the audit crowd

Compliance is the byproduct.

You don't prepare for an audit with Nokku. You open the log.

  • Every session is evidence

    Recorded, replayable, and tied to an SSO identity, not to an anonymous key file.

  • Access grants are assignments

    Granted and revoked in one place, with a full history. Offboarding is one click, not a scavenger hunt.

  • Auditor questions, answered

    Who had root on prod-db-01 in March? Export the trail and your ISO 27001 / NIS2 access-control evidence is ready in one step.

  • EU by architecture

    GDPR by design, engineered and hosted in the EU by default, not by addendum.

  • GDPR by design
  • EU hosted
  • full audit trail
  • session replay
audit.log · live tailREC
14:02:11alice@acme.comcert.issuedprod-db-01principal root · ttl 4h
14:02:14alice@acme.comsession.startprod-db-01recording #8412
14:07:53ci-deploy@acme.comcert.issuedstaging-02principal ubuntu · ttl 1h
14:19:36bob@acme.comaccess.deniedprod-db-01no assignment for root
14:31:02admin@acme.comprincipal.grantedprod-cache-03team sre → ubuntu
14:44:58alice@acme.comsession.endprod-db-0142m · replay stored

the audit trail your ISO 27001 / NIS2 auditor will ask for

Trust, but verify

Don't trust us. Read the code.

A security product earns trust by being transparent, not by asking for it.

Fair Core License

nokkucore

Source-available, converting to open source two years after each release. Self-host with a license key when your compliance perimeter can't leave your own infrastructure.

Apache-2.0

nokkuddaemon

Fully open source. Verify exactly what runs on your servers before it ever touches sshd.

View source
Apache-2.0

nkcli

Fully open source. The tool that handles your credentials is auditable to the last line.

View source

Built and operated independently in Austria · Hosted in the EU

Early access

Get a taste before launch.

Drop your email and we'll let you know when the self-hosted core and the hosted cloud are ready. No spam, no drip campaigns, just a heads-up when there's something to try.

Ready when you are

Stop managing keys.Start issuing certificates.

Create your workspace, enroll your first server, assign your team. Done before your coffee gets cold.

Join the waitlistRead the quickstart

nk and nokkud are open source (Apache-2.0). Read every line that runs on your servers.