Private software infrastructure

Access doesn't stop at the key.

Obsidian keeps software access under continuous server authority, from license issuance and device binding to entitlements, sessions, delivery and revocation.

Request access Explore the platform

Already invited? Sign in

Signed sessions
6 SDKs
PKCE hosted login
Device binding
Scoped APIs
Live revocation

02Continuous authority

The license opens the door.
Obsidian decides whether it stays open.

A key check happens once. Authorization does not. Every session heartbeats every five seconds, and every heartbeat re-reads the license, the customer, the product, the application, the device and the version the way they are now.

A key is where access starts. What Obsidian holds is everything after it.

Signed answers: Cryptographically signed authorization responses, verified under a key you pin.
Re-evaluation: Every heartbeat re-evaluates the whole policy, not just the token.
Rotation: Session tokens rotate every heartbeat; a stolen old token is dead on arrival.
Replay: Nonce and clock binding on every request; replays are refused before they touch the database.
Revocation: Revocation reaches running sessions: refused at the next heartbeat, and pushed to connected clients.
Outage: Fails closed: an outage denies, it never grants.

Licenseissued, bound to a product and its terms
Entitlementsresolved through six layers, each value with its source
Customerthe holder, however they proved it
Devicebound by keyed digest, within the cap
Sessiona signed envelope with a rotating token
Heartbeatevery 5 s: the whole policy again, or a refusal

03Licensing

Build access around the product, not around a key table.

Products carry terms. Variants, plans, promotions, licenses and overrides layer on top, and one resolver, the same function the runtime calls, says what each holder has and why.

Licenses · Atlas Studio · productionDemo data

Key	Product	Expires	Devices	Status
ATL-••••-••••-7Q2K	Pro · annual	2027-03-02	1 / 2	active
ATL-••••-••••-M4XA	Pro · lifetime	Lifetime	2 / 2	active
ATL-••••-••••-19HV	Team · floating	2026-11-30	seats 7 / 10	active
ATL-••••-••••-C8RD	Pro · monthly	frozen · 21 d held	1 / 2	frozen
ATL-••••-••••-0ZLP	Pro · monthly	2026-09-01	0 / 2	expired

ExpirationExpiration, lifetime access, stacking, freeze and resume. Every change to a license's time is a recorded, reproducible entry.
Device policyConcurrency-safe first-device binding.
FloatingFloating licensing with a seat budget that holds under concurrency.
EntitlementsEntitlements resolve through six layers with one implementation, and every value says where it came from.
ChannelsRelease channels per license, reported in the runtime answer.
BulkBulk issuance in one transaction; keys shown again only as an audited reveal.
AvailabilityMaintenance drains instead of ejecting; version floors are enforced numerically.

Everything licensing can do

04Resellers

A reseller network without a seat tax.

Resellers are their own population with their own console, their own operators and their own credit ledger. What they may sell, for how long, on how many devices and with what powers is policy: set by you, narrowed by them for anyone beneath them, never widened.

Selleryour organization

Teamowner · developer · seller · managers

Reseller APro, Team · 365 d · 2 devices · may revoke

Productsonly what is granted

Sub-resellerPro · 90 d · 1 device

Reseller Ballowance pool · 200 keys / month

Grants: Product-specific grants, duration and device ceilings, and per-reseller capabilities, all re-checked on every issuance.
Ledger: Reseller credits are backed by an append-only ledger; concurrent issuance cannot overdraft.
Sub-resellers: Sub-resellers inherit only what their parent holds, and fall with it.
Pools: Periodic allowance pools with unclaimed keys revoked at close.
API: Reseller API access, confined to the reseller's own licenses.
Ownership: Licenses a reseller issues are attributed to it, so its branch sees exactly its own; ownership by the holder is a separate axis.

The reseller system in detail

05Customer identity

One customer. Every way they prove access.

License key, password, magic link, Discord and passkey sign-in, per application and under your policy.

Sign-in methods · Atlas StudioDemo data

License key: enabled · the key is the account
Password: enabled · paired with an address
Magic link: enabled · single use, one holder
Discord: enabled · verified address match
Passkey: enabled · RP = your hostname
Hosted login: client registered · PKCE S256

Four populations. Four cookies, four session tables, no shared door.

Operators, members, resellers and customers are separate security populations, with separate cookies, separate sessions and separate tables.

Hosted login: Authorization Code + PKCE, with license gating and refresh-token reuse detection.

How the boundaries are drawn

06Developers

Six SDKs. One contract.

Six SDKs (JavaScript, Python, Go, Rust, C#, C++) held to one contract by one set of vectors.

Installsh

npm install ./sdks/javascript   # @obsidian/sdk, from the repository

session.tsts

import { ObsidianClient, DenialError } from "@obsidian/sdk";

const client = new ObsidianClient({
  url: RUNTIME_ORIGIN,              // https://auth.obsidian.rip
  applicationId: APPLICATION_ID,
  environment: "production",
  publicKey: PINNED_ED25519_PUBLIC_KEY, // pinned out of band, never fetched
  onState: (claims, error) => showAccessState(Boolean(claims), error?.message),
});

try {
  await client.initialize({
    license,                        // or { bridge_token } after a hosted sign-in
    client_version: "1.0.0",
    fingerprint,
    fingerprint_version: 1,
  });
  client.startHeartbeats();         // every 5 s; a refusal clears client.session

  const stream = client.subscribe({
    onSessionEnded: (push) => console.log("ended:", push.action, push.reason),
    onConfigChanged: () => reloadWhatYouCached(),
  });

  if (client.session?.entitlements["feature.pro"] === true) unlockPro();
} catch (e) {
  if (e instanceof DenialError) show(e.code, e.reason); // reason only if signed
}

Trimmed from sdks/javascript/src/index.ts; the full example is under sdks/javascript/examples and runs against the runtime in the suite where the toolchain is available.

Management API

Scoped management credentials: explicit scopes, application or organization binding, product confinement, rotation with grace.

A generated OpenAPI 3.1 reference for the management API, public.

Webhooks and the feed

Webhooks that are signed, retried, inspectable and replayable.

Event catch-up from an exact, gap-free sequence. No webhook required.

Live and typed

Live, signed notifications to running clients. The heartbeat stays the authority.

Typed remote configuration in the signed answer, with server-only values that never leave the control plane.

CLI and hosted login

A CLI for the management API, credential from the environment, never an argument.

Hosted login: Authorization Code + PKCE, with license gating and refresh-token reuse detection.

Read the documentation Management API reference

07Fulfilment

From payment to permission.

From payment to permission: normalised orders, idempotent fulfilment, every step recorded and replayable.

Order paidSellAuth or your own signed storefront contract
Customerfound or created by address, once
Licenseissued exactly once per line; a retry reads it back
Entitlementsresolved from the product the line mapped to
Downloada grant, when the release requires the entitlement
Discordroles granted through the outbox
Webhooksigned, retried, replayable

Fulfilment · order #A1-2291 · line 1Demo data

Step	Outcome	Detail
map	succeeded	variant → Pro · annual
customer	succeeded	found by address
issue	succeeded	1 key, receipt sa_9f…
notify	succeeded	purchase mail, brand Atlas
issue (retry)	skipped	already delivered; keys read back

Discord roles that follow licenses and entitlements, granted and removed by the platform, never by hand.

Bundles, invites and coupons that resolve to the same license rows as everything else.

Providers: SellAuth and a signed custom contract.

08Software delivery

Ship privately. Authorize every download.

Private object storage; five-minute authorized downloads; every grant recorded.

Releases · Atlas StudioDemo data

Channel	Version	SHA-256	Requires	Provenance
stable	2.4.1	e3b0…b855	none	approved · CI
beta	2.5.0-b3	9f86…0a08	feature.beta	approved · staff
nightly	2.5.0-n214	2c26…2d3d	feature.nightly	unapproved

Storage: Private object storage; five-minute authorized downloads; every grant recorded.
Gate: Downloads can require a current entitlement.
Channels: Release channels per license, reported in the runtime answer.
Provenance: SHA-256 and approved provenance on every file; per-holder watermarked builds, sealed and revocable.

Watermarking identifies a leaked artifact; it is not anti-tamper.

09Migration

Switch the infrastructure, not the business.

Discover, map, dry-run, import, verify. From an Obsidian archive, a KeyAuth export, CSV or JSON.

Source
Discover
Map
Dry run
Import
Verify

Import · keyauth-export.json · dry runDemo data

Source: KeyAuth license export
Rows: 1,204 staged · 1,198 ready · 6 refused
Products: level 1 → Pro · level 2 → Team
Refusals: 6 × unknown level 3 (no product mapped)
Written: nothing. A dry run writes nothing.

KeyAuth is the only named third-party format; other systems go through CSV or JSON.

10White label

Your customers shouldn't need to know we're here.

Your portal, store and hosted login on your own hostname, verified by DNS, with the certificate issued at the edge.

Custom hostsDemo data

Hostname	Serves	DNS	Edge
portal.atlas.example	portal · brand Atlas	verified	certificate live
store.atlas.example	storefront → portal	verified	certificate live
login.atlas.example	hosted sign-in	pending TXT	waiting

Brand name, logo, accent and support identity on every holder-facing surface.

The workspace, the reseller console and the operator console are never served on a seller's hostname. The holder-facing surfaces are, and only those.

No custom typography and no custom scripts on sign-in surfaces, by design.

Obsidian

Keep authority where it belongs.

One control plane from purchase to heartbeat. Built for sellers who have outgrown a key table.

Request private access View documentation

Already invited? Sign in