From first host to a governed fleet.
Practical instructions for users, administrators, identity teams, and platform operators. Start with the path that matches the job you need to do.
Choose your path
Understand the resource model, bootstrap a tenant, create a host group, and enroll the first host.
Sign in to the CLI, enroll a hardware-backed key, request access, and launch the system OpenSSH client.
Configure OIDC sign-in and SCIM provisioning with exact immutable identity matching and group-based roles.
Stage signed packages, distribute one-use per-host credentials, canary each platform, and expand in observable waves.
How Tenvyr changes SSH access
Tenvyr is a control plane, not an SSH proxy. It governs identity, approvals, certificate issuance, host trust, and evidence. The actual SSH connection goes directly from the user’s system OpenSSH client to the target host.
User CLI ── requests approval and certificate ──> Tenvyr
User OpenSSH client ───────── direct SSH ───────> Host
Host agent ───── outbound identity + state ─────> TenvyrPrivate SSH keys remain on the user device. Host agents expose no inbound Tenvyr listener, and short-lived user certificates are capped at ten minutes.