Docs

A short reference for what Gateway does today and how to use it.

Getting started

Sign in with an identity provider configured for this deployment. Gateway creates your account on first sign-in; there is nothing to register separately.
Add a server: give it a name, hostname, port, SSH username, and a connection region. Gateway generates an Ed25519 SSH identity for it automatically.
Copy the generated public key from the server's SSH identity tab and append it to the target account's authorized_keys file yourself. Gateway does not connect to the server to do this for you. The line looks like this:
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKk3f9…redacted…7fQe gateway:srv_2Y8QK1M
```
Rotate or revoke the identity at any time from the same tab. Both actions require a recent step-up reauthentication.

Regions

A region is a connection boundary, not a data center guarantee. Each region publishes the IPv4 and IPv6 addresses a future executor in that region would connect from, so you can allowlist them on your own firewall ahead of time.

Files

Files can be uploaded standalone or associated with a specific server. They are stored in a dedicated R2 bucket, addressed only by internal identifiers, and are only ever returned to the account that uploaded them.

Activity

Every sign-in, identity change, file operation, and billing event is written to an append-only log, visible per-server and account-wide. Nothing is ever edited or removed from it by application code, even when the resource it describes is later deleted.

Known limitations

There is no execution plane. Gateway does not open SSH connections, run commands, or check whether a server is actually reachable; server status reflects control-plane state only.
Rotating an identity generates and stores a new keypair in Gateway. Installing the new public key on the remote host is a manual step until an executor exists.
Account recovery is delegated entirely to your identity provider.
The credential lease endpoint reserved for a future executor fleet authenticates machines with a hashed shared-secret registry today, intended to be replaced by mutual TLS or a managed service-token mechanism.