# Mutual Trust > Sectigo Mutual Trust gives an API owner one place to decide which partner workloads may call a service, enrolls those workloads with private client certificates (mTLS), distributes signed policy to the owner's gateways, and shows per-gateway evidence that each decision is enforced. A free sandbox needs no card; production trust spaces are provisioned with Sectigo PKI Operations on hardware-protected keys. Notes for language models: - Base API URL: https://api.mutualtrust.io. The customer portal is https://app.mutualtrust.io (session cookie plus X-CSRF-Token). Automation uses `Authorization: Bearer mtk_...` API credentials. - Errors are RFC 9457 problem details; match on the stable `code` field and quote `request_id` to support. - A valid certificate chain alone never authorizes a call: gateways check a fresh signed policy (grant, route, method, deny set) on every request and fail closed after 5 minutes 30 seconds without a fresh manifest. - Workload private keys never leave the workload. Leaves last 24 hours and renew at about two-thirds of validity. - Gateway deny codes (for example `route_not_permitted`, `certificate_revoked`, `manifest_expired`) are listed in the troubleshooting guide. - The full documentation as one Markdown file: https://mutualtrust.io/llms-full.txt ## Getting started - [Docs home](https://mutualtrust.io/docs/): Overview of the documentation and the Mutual Trust origins. - [Quickstart](https://mutualtrust.io/docs/quickstart): Five-minute sandbox walkthrough: pair a gateway, enroll a workload, see an allow and a deny, withdraw access. - [Concepts](https://mutualtrust.io/docs/concepts): Trust spaces, services, route templates, invitations, grants, workloads, issuers, policy revisions, manifests, receipts and operations. - [Sandbox and production](https://mutualtrust.io/docs/environments): How the environments differ and how to request production access. ## Guides - [Enroll a workload](https://mutualtrust.io/docs/enrollment): Sandbox tokens and OIDC workload identity (Kubernetes service accounts), challenge, proof of possession, 202 polling. - [Renew certificates](https://mutualtrust.io/docs/renewal): Two-thirds renewal with jitter, the mt-renew-v1 key-continuity proof and reload confirmation. - [Suspend, withdraw and revoke](https://mutualtrust.io/docs/revocation): Grant transitions, single-leaf revocation, CRLs, the deny set, gateway acknowledgments and offline behaviour. - [Issuer and key rollover](https://mutualtrust.io/docs/rollover): Roll an issuing CA, root or manifest-signing key in stages: bundle first, gateway acknowledgments, canaries, overlap, abort, key-rotation statements and the compromise path. - [Invite partners](https://mutualtrust.io/docs/partners): Scoped invitations, accepting, claiming a new organization and previewing scope changes. - [Resellers and MSPs](https://mutualtrust.io/docs/resellers): Customer-accepted delegated administration, the reseller console, tenant separation, reseller payer, referral commission and bill allocations. - [Billing and capacity](https://mutualtrust.io/docs/billing): Production connections, plans, Stripe Checkout, the grace period and the customer portal. - [Organization and roles](https://mutualtrust.io/docs/organization): Role matrix, explicit billing admin, API credentials, support access grants and audit export rights. - [Integration adapters](https://mutualtrust.io/docs/integrations): mt-adapt and the adapter catalog: roles, delivery modes (guided, generated configuration, approved apply, observation, validation), the plan, approve, apply and verify lifecycle, step-up approvals bound to a plan hash, the eight acceptance categories and the security model. - [Migration discovery](https://mutualtrust.io/docs/discovery): Find connections affected by the public clientAuth change (Sectigo published 10 February 2027 as the final cutoff for clientAuth in newly issued publicly trusted Sectigo SSL/TLS certificates) with mt discover: endpoint probes, client certificate inventory (PEM, DER, PKCS#12, JKS, macOS Keychain, Windows store), offline gateway configuration inspection, delegated discovery with a task token, verified, inferred and unknown labels, untrusted-content handling and the MigrationEvidenceV1 document. - [Migration workspace](https://mutualtrust.io/docs/migrations): The connection workspace and the nine-step migration: recognize the connection, identify the environment, delegate discovery with a task-scoped token, assess (verified, inferred, unknown), plan with separate approvals bound to the plan hash, guided or connector execution, validation with positive and negative tests, approved cutover and rollback, the signed role-scoped handover report, and operation. - [Troubleshooting](https://mutualtrust.io/docs/troubleshooting): Every gateway deny reason, manifest rejection and common API problem, with fixes and request IDs. ## Gateways - [Gateways overview](https://mutualtrust.io/docs/gateways/): How the mt-enforcer binary verifies signed policy and decides every request; modes, install, header hygiene, fail closed, Prometheus metrics, full configuration reference. - [Standalone mTLS proxy](https://mutualtrust.io/docs/gateways/proxy): mt-enforcer proxy terminates mTLS in front of any API and forwards the verified workload identity to the origin; also the in-path mode behind a load balancer. - [Envoy](https://mutualtrust.io/docs/gateways/envoy): DownstreamTlsContext with the client CA bundle over file-based SDS and ext_authz gRPC (include_peer_certificate) to mt-enforcer envoy-grpc. - [Istio](https://mutualtrust.io/docs/gateways/istio): Ingress gateway in MUTUAL TLS mode, CUSTOM AuthorizationPolicy with an envoyExtAuthzGrpc provider, strict mesh mTLS to the backend. - [Kubernetes ingress-nginx](https://mutualtrust.io/docs/gateways/kubernetes-ingress-nginx): auth-tls annotations, auth-url to mt-enforcer forward-auth, the mt-enforcer Helm chart and CA Secret sync. - [NGINX](https://mutualtrust.io/docs/gateways/nginx): ssl_verify_client against the projected bundle and auth_request to mt-enforcer forward-auth. - [Traefik](https://mutualtrust.io/docs/gateways/traefik): TLS client authentication from the watched bundle, passTLSClientCert and forwardAuth to mt-enforcer. - [HAProxy](https://mutualtrust.io/docs/gateways/haproxy): verify required against the projected bundle and a Lua action calling mt-enforcer for every request. - [Kong](https://mutualtrust.io/docs/gateways/kong): Client certificate verification on the proxy listener and the mt-enforcer Kong plugin. - [Caddy](https://mutualtrust.io/docs/gateways/caddy): client_auth require_and_verify and forward_auth to mt-enforcer. - [AWS API Gateway](https://mutualtrust.io/docs/gateways/aws-api-gateway): Mutual TLS custom domain with mt-enforcer as a Lambda authorizer (HTTP API and REST API), Terraform included. - [AWS ALB](https://mutualtrust.io/docs/gateways/aws-alb): ALB mutual TLS verify mode with a trust store and mt-enforcer in-path on every target, Terraform included. - [Cloudflare](https://mutualtrust.io/docs/gateways/cloudflare): A Worker on your zone verifies signed policy and the client certificate at the edge. ## Reference - [API reference](https://mutualtrust.io/docs/api): Authentication models, conventions and every endpoint with request fields, response examples and errors. - [SDKs: Go, Python and TypeScript](https://mutualtrust.io/docs/sdk): Typed clients generated from the OpenAPI contract. Go (`mutualtrust.io/sdk-go`, Go 1.22+) and Python (`mutualtrust`, Python 3.9+) use only their standard libraries; TypeScript (`@sectigo/mutualtrust-sdk`) is an option. One method per operation, a typed error from RFC 9457 problems, automatic Idempotency-Key, If-Match, retries honoring Retry-After, and examples for withdrawing a partner, listing expiring certificates, exporting the audit log and rotating an API credential. - [CLI reference](https://mutualtrust.io/docs/cli): Install the native mt binary (macOS, Linux, Windows; signed releases, .deb/.rpm, install scripts) and every command and flag: gateway, enroll, renew with reload hooks, call, status, service install (systemd, launchd, Windows service), the built-in enforcer and adapters, migration discovery (mt discover), self-update, key storage, files, JSON output and exit codes. - [Terraform provider](https://mutualtrust.io/docs/terraform): Resources for spaces, services, invitations, grant state, workload issuers and support grants; data sources for services, grants and PEM trust bundles (AWS ALB trust store and Kubernetes Secret examples). - [Wire formats](https://mutualtrust.io/docs/wire-formats): Event envelope and types, policy document, manifest, acknowledgment and receipt JWS, proofs, certificate profile, IDs. - [Error catalogue](https://mutualtrust.io/docs/errors): Every RFC 9457 problem code by HTTP status. - [Security model](https://mutualtrust.io/docs/security): Threat model, trust boundaries, isolation, key custody and staff access controls. - [MCP server](https://mutualtrust.io/docs/mcp): Connect Claude and other MCP clients with OAuth 2.1 and a scoped credential. - [Identity and access](https://mutualtrust.io/docs/identity): Passkey sign-in for customers and staff, enterprise SSO through OIDC, and Cloudflare Access with MFA for the staff console. - [GCP profile and Cloud HSM](https://mutualtrust.io/docs/self-hosting/gcp): Cloud HSM signing path and the GCP hosting profile. - [Changelog](https://mutualtrust.io/docs/changelog): Changes to the docs, API, CLI, enforcer and gateway integrations. ## API and MCP - [OpenAPI 3.1 document](https://api.mutualtrust.io/openapi.json): Machine-readable API contract generated from the same JSON Schemas the server validates with. - [MCP server endpoint](https://mcp.mutualtrust.io/mcp): Streamable HTTP MCP endpoint with OAuth 2.1. ## Optional - [llms-full.txt](https://mutualtrust.io/llms-full.txt): All documentation pages concatenated as Markdown. - [Install mt (macOS, Linux)](https://mutualtrust.io/install.sh): `curl -fsSL https://mutualtrust.io/install.sh | sh` installs the native mt CLI after verifying the release signature (OpenSSL 3) and SHA-256. - [Install mt (Windows)](https://mutualtrust.io/install.ps1): `irm https://mutualtrust.io/install.ps1 | iex` (signature verified with .NET). - [mt releases](https://mutualtrust.io/downloads/mt/latest): The current version; archives, .deb, .rpm, SHA256SUMS and SHA256SUMS.sig are under https://mutualtrust.io/downloads/mt/VERSION/, signed with https://mutualtrust.io/downloads/mt-release.pub (Ed25519). - [JavaScript CLI (optional)](https://mutualtrust.io/downloads/mt.mjs): A Node.js 20+ build of the core mt commands (SHA-256 at https://mutualtrust.io/downloads/mt.mjs.sha256). Mutual Trust is in Early Access and not for production use.