One certificate. Every project trusts you.¶
Obsidian is a personal, central auth service that silently authenticates your own pre-authorized devices — laptops, phones, servers — using mutual TLS, and issues short-lived JWTs your other projects' APIs can verify without ever calling Obsidian back.
No passwords, ever¶
Devices prove who they are with a client certificate presented during the TLS handshake itself — there's nothing to type, phish, or leak.
Short-lived by default¶
Every issued JWT expires in an hour. A compromised token is a non-event by the time anyone notices.
No callbacks per request¶
Your other services verify tokens locally against Obsidian's JWKS — one key fetch, cached, and no network round-trip to Obsidian on the hot path.
One switch to revoke¶
Every device is a row in a table. Flip it to revoked and the next token request fails instantly — no cert rotation required.
Where to go next¶
- What is Obsidian? — the problem it solves and the vocabulary (mTLS, device certs, JWTs, JWKS) used throughout these docs.
- How it works — the request path from a device's handshake to a verified API call, with a diagram.
- API examples — copy-paste snippets for integrating Obsidian into your own Python and JavaScript projects.
Looking for deployment instructions?
These docs cover the API surface for the projects that consume Obsidian tokens. For standing up Obsidian itself (Terraform, AWS, device provisioning), see the repository README.