Mutual Trust documentation

Getting started

• Five-minute quickstart

  Create a sandbox space, pair a gateway, enroll a workload and see one allowed and one denied request, then withdraw access.

• Concepts

  Trust spaces, services, route templates, invitations, grants, workloads, issuers, policy revisions, manifests, receipts and operations.

• Sandbox and production

  What differs between environments, how the two are kept unmistakable, and how to request production access.

Guides

• Enroll a workload

  Sandbox tokens and OIDC workload identity (including Kubernetes service accounts), challenge, proof of possession and 202 polling.

• Renew certificates

  Two-thirds renewal with jitter, the key-continuity proof, reload confirmation and recovering from an expired leaf.

• Withdraw access

  Suspend, resume and revoke grants, revoke a single leaf, CRLs, the deny set, gateway acknowledgments and offline behaviour.

• Invite partners

  Scoped invitations, accepting and claiming an organization, and previewing scope changes before you publish them.

• Billing and capacity

  What counts as a production connection, plans, Stripe Checkout, the grace period and the customer portal.

• Organization and roles

  The role matrix, explicit billing administration, API credentials, support access grants and audit export rights.

• Troubleshooting

  Every gateway deny reason, every API problem code, and how to use request IDs.

Gateways

Mutual Trust enforces at your ingress. The gateway guides cover Envoy, Istio, Kubernetes ingress-nginx, NGINX, Traefik, HAProxy, Kong, Caddy, AWS API Gateway, AWS ALB, Cloudflare and the standalone mTLS proxy. Every gateway applies the same verification rules.

Reference

• API reference

  Authentication models, conventions and every endpoint with request fields, response examples and errors.

• CLI reference

  Every mt command and flag, the files it writes and its exit codes.

• Wire formats

  Event envelope and types, manifest JWS, policy document, acknowledgments, receipts, proofs, certificate profile and IDs.

• Error catalogue

  RFC 9457 problem details and every stable code the API returns.

• Security model

  Threat model, trust boundaries, tenant isolation, key custody and staff access controls.

• MCP server

  Connect Claude and other MCP clients to your organization with a scoped, revocable credential.

• Identity and access

  Passkey sign-in for customers and staff, enterprise SSO through OIDC, and how sessions and assertions are verified.

• GCP profile and Cloud HSM

  The production signing path from Cloudflare to Cloud HSM, and the full GCP hosting profile.

• Changelog

  What changed in the docs, API, CLI, enforcer and gateway integrations.

Machine-readable resources

• OpenAPI 3.1 document
• llms.txt: index of these docs for language models
• llms-full.txt: the full docs as Markdown

Origins