Smallstep

Smallstep is a device identity platform that issues short-lived certificates to people, devices, services and AI agents. Its open source certificates project on GitHub is a private certificate authority that teams can run themselves.

The platform uses hardware-backed, short-lived certificates in place of shared API keys. Teams can use mTLS to authenticate internal APIs, AI workloads and MCP servers, and can restrict access to trusted devices. The company also describes ACME Device Attestation, a standard it co-developed with Google at the IETF.

• Short-lived certificates for people, devices and workloads
• Hardware-bound credentials for trusted devices
• mTLS for APIs, AI workloads and MCP servers
• Device inventory that flags items needing attention
• Open source certificates project on GitHub

Smallstep suits security and IT teams that want to replace shared API keys with cryptographic identity. It also fits platform engineers who need mTLS between internal services, and organisations that care about hardware-bound access to their devices.

The certificates project is open source under the Apache-2.0 license. The commercial Device Identity Platform is sold through a demo request, and the site lists a pricing page. The company describes its platform as a zero trust approach that verifies devices as well as users.