NKS signs ephemeral SSH certificates on Cloudflare's edge. One API call returns a signed cert with a 15-minute TTL. No static keys. No SDKs. No infrastructure to manage.
How It Works
From API call to SSH connection in under a second. No key rotation, no vault management, no agent SDKs.
Your AI agent sends its public key and the target host to the NKS API. One POST request. No SDK required.
POST
/v1/credentials/ssh-cert
{
"publicKey": "ssh-ed25519 AAAA..."
"host": "production"
}
NKS signs an Ed25519 certificate on the nearest Cloudflare edge node. 600ms median latency. Globally distributed.
// Signed on edge (Frankfurt)
Algorithm: Ed25519
Latency: 612ms
PoP: FRA
Serial: nks_c_9f8a...
The agent SSHes using the signed certificate. After 15 minutes the cert expires automatically. Nothing to revoke.
$
ssh -i cert.pub prod@10.0.1.5
Connected.
# 15 min later...
Certificate expired.
# No revocation needed.
Why NKS
Static keys are a liability. NKS replaces them with ephemeral, auditable, zero-infrastructure credentials.
No private keys on disk. No key rotation schedules. Every credential is born with a death sentence. Certificates auto-expire after 15 minutes.
Runs on Cloudflare Workers across 300+ locations. Certificates are signed at the nearest PoP. Sub-second latency from anywhere on earth.
No SDKs. No client libraries. No agents to install. A single HTTP POST returns a signed certificate. Works with curl, Python, Go, or any language.
Every certificate issuance is logged with serial number, requesting agent, target host, timestamp, and edge location. SOC 2 and compliance ready.
Designed for AI agents, CI/CD pipelines, and automated workloads. No human-in-the-loop. Agents request credentials when they need them, not before.
At $0.000001 per certificate, NKS costs a fraction of traditional secret management. No servers to run. No licenses to renew. Pay only for what you sign.
Compare
Purpose-built for ephemeral credentials. Not a general-purpose vault with SSH bolted on.
| NKS | Teleport | HashiCorp Vault | Smallstep | |
|---|---|---|---|---|
| Setup Time | 5 minutes | Hours to days | Days to weeks | Hours |
| Infrastructure | None (edge) | Auth proxy + nodes | Server cluster | CA server |
| Signing Latency | 600ms (edge) | 1-3s | 2-5s | 500ms-2s |
| Agent SDK Required | No | Yes (tsh/tbot) | Yes (vault agent) | Yes (step CLI) |
| Cost (10K certs/mo) | $0.01 | $500+/mo | $1,200+/mo | $300+/mo |
| Global Edge | ||||
| Audit Trail | ||||
| AI Agent Optimized |
Pricing
Start free. Scale to millions of certificates. No hidden fees. No per-seat charges.
For experimentation
For small teams
For production workloads
For security-critical orgs
Get your first certificate in 5 minutes. Free tier includes 1,000 certificates per month. No credit card required.