One key for everything.
One sign-in for every internal app and server. Passkeys instead of passwords, and SSH certificates that expire on their own.
Most identity providers stop at your apps. Fob covers your servers too, so new starters have access on day one, contractors reach only what you give them, and one click locks a leaver out of all of it.
Single sign‑on
Connect anything that speaks OIDC or SAML, from AWS and Grafana to the tools you built yourself. Assign each app to the groups that use it, and your team signs in once and finds them all on one page.
- OIDC
- SAML 2.0
- SCIM 2.0
- WebAuthn
- TOTP
- OpenSSH
Sign in with passkeys
Passkeys are phishing-resistant and can't be reused across sites. Require them for your critical applications, and screen any remaining passwords against known breach data. If your organization uses Google Workspace, Microsoft Entra ID or Okta, employees can sign in with their existing accounts.
SSH without long‑lived keys
Authenticate from the terminal and receive a short-lived SSH certificate that expires automatically. There are no keys to distribute, and none to revoke when an employee leaves. Servers connect outbound to Fob, so no inbound ports are needed. Terminal sessions are recorded for replay.
Sign‑on policies
Decide what each app requires: a passkey, a second factor, a trusted network or a recent sign-in. Rules run in order and the first match decides, and you can check what any person would get before you rely on it.
Security, by design
Fob holds the keys to the rest of your infrastructure, so security isn't an add-on. It shapes every decision, from how keys are stored to how long access lasts.
- Phishing‑resistant by default
- Passkeys are enabled by default, and remaining passwords are screened against known breaches.
- Short-lived access
- Certificates expire automatically, and offboarding revokes access immediately.
- Encrypted at rest
- Signing keys, SSH CA keys and authenticator secrets are all encrypted.
- Isolated by organization
- Each organization has its own directory, signing keys and sign-in host.
- Complete audit trail
- Every sign-in and change is logged, and terminal sessions can be replayed.
- Built on open standards
- OIDC, SAML, SCIM and OpenSSH, with no proprietary SDK required.
Give everyone their own key.
Single sign-on, passkeys and logs are on the free plan. Tell us about your team and we'll get you started.