Privileged access, finally built for Kubernetes & SSH.

Replace static SSH keys, kubeconfigs, and standing admin with short‑lived, audited access, all without changing how your engineers work.

~/twingate · privileged access

~/twingate · privileged access

~/twingate · privileged access

Your identity is the perimeter. Treat it like one.

Kill standing access

Long‑lived SSH keys and kubeconfigs are hard to revoke and easy to steal. Twingate binds every session to identity and expires it in minutes, not months.

Audit every action

Every kubectl call and SSH session is tied to a real human and recorded, giving your team identity-specific forensics in seconds, not days.

Eliminate workflow tax

Engineers keep using `ssh` and `kubectl`. No bastion juggling, no custom CLIs, no jump hosts. Off‑boarding drops access globally in one click.

Stop sharing kubeconfigs.
Start shipping.

Twingate extends Zero Trust past the network connection into every kubectl verb, namespace, and resource. Available now, free for up to five resources.

Identity propagation, end‑to‑end

Twingate forwards the user's verified identity to your cluster. No separate kubeconfig per engineer, no shared service accounts.

Identity propagation, end‑to‑end

Twingate forwards the user's verified identity to your cluster. No separate kubeconfig per engineer, no shared service accounts.

Clusters off the public internet

Control planes stay private. Access is brokered by Connectors deployed inside your VPC, invisible to the public internet.

Clusters off the public internet

Control planes stay private. Access is brokered by Connectors deployed inside your VPC, invisible to the public internet.

Automatic configuration

Cluster visibility and access are always up to date, with kubeconfig files automatically synced to users' devices, so teams connect instantly.

Automatic configuration

Cluster visibility and access are always up to date, with kubeconfig files automatically synced to users' devices, so teams connect instantly.

End‑to‑end visibility

DevOps and Security finally see the same picture: who connected, from where, on what device, and exactly which kubectl calls they made.

End‑to‑end visibility

DevOps and Security finally see the same picture: who connected, from where, on what device, and exactly which kubectl calls they made.

~/twingate · privileged access

$ kubectl auth whoami
ATTRIBUTE   VALUE
Username    your-identity-from-okta@bar.com
Groups      [group-from-okta engineering platform-team system:authenticated]

$ cat ~/.kube/config
clusters:
- cluster:
    certificate-authority-data: ...
    server: https://prod-cluster.int
  name: twingate-managed-cluster
users:
- name: twingate-managed-user
  user:
    token: null  
contexts:
- name: twingate-managed-cluster
  context:
    cluster: twingate-managed-cluster
    user: twingate-managed-user
current-context: twingate-managed-cluster
kind: Config
apiVersion: v1
$ kubectl auth whoami
ATTRIBUTE   VALUE
Username    your-identity-from-okta@bar.com
Groups      [group-from-okta engineering platform-team system:authenticated]

$ cat ~/.kube/config
clusters:
- cluster:
    certificate-authority-data: ...
    server: https://prod-cluster.int
  name: twingate-managed-cluster
users:
- name: twingate-managed-user
  user:
    token: null  
contexts:
- name: twingate-managed-cluster
  context:
    cluster: twingate-managed-cluster
    user: twingate-managed-user
current-context: twingate-managed-cluster
kind: Config
apiVersion: v1

jane@laptop · ~

RECORDING

$ ssh ops@db-primary.prod.acme.io
→ resolving via twingate gateway
→ identity: jane@acme.io · device: trusted
→ policy match: prod-db-readonly · ttl 5m
→ short‑lived cert issued · session id 8a3f…


Welcome, jane. This session is recorded.


ops@db-primary:~$ psql -c "SELECT count(*) FROM users"
count

————-

1284192

$ ssh ops@db-primary.prod.acme.io
→ resolving via twingate gateway
→ identity: jane@acme.io · device: trusted
→ policy match: prod-db-readonly · ttl 5m
→ short‑lived cert issued · session id 8a3f…


Welcome, jane. This session is recorded.


ops@db-primary:~$ psql -c "SELECT count(*) FROM users"
count

————-

1284192

$ ssh ops@db-primary.prod.acme.io
→ resolving via twingate gateway
→ identity: jane@acme.io · device: trusted
→ policy match: prod-db-readonly · ttl 5m
→ short‑lived cert issued · session id 8a3f…


Welcome, jane. This session is recorded.


ops@db-primary:~$ psql -c "SELECT count(*) FROM users"
count

————-

1284192
ops@db-primary:~$ sudo rm -rf /
→ blocked by policy: destructive ops require approval
→ slack: @sre-oncall notified


0

0

KEYS DISTRIBUTED

KEYS DISTRIBUTED

5 min

5 min

CERT LIFETIME

CERT LIFETIME

100%

100%

REPLAYABLE SESSIONS

REPLAYABLE SESSIONS

Your identity is the new SSH key.

Zero trust controls on every SSH session without keys, bastions, or custom tooling. Currently in early access, free for up to five resources.

No SSH keys on devices

Twingate authenticates the user, then issues a short‑lived certificate per connection. Nothing to distribute, nothing to leak, nothing to rotate.

Full session auditing

Every keystroke and command is attributed to a real identity. Recordings are stored in asciicast v2 on your infrastructure for replay and compliance.

Plain ssh, no new tools

Engineers connect with the standard ssh command. No custom CLI, no bastion choreography, no behavior change to roll out.

Instant offboarding

Revoke a user's Twingate access and all SSH access disappears in the same instant, across every host. No manual SSH server clean-up

Privileged Access · Web Apps

Internal web apps, identity all the way down.

Bring the same identity‑bound, fully audited model to your internal dashboards, admin panels, and HTTP APIs, all without navigating reverse proxies, fighting with VPNs, or deploying a single line of app code.

Identity-aware HTTP access

Authenticate users at the request layer — every request to internal apps carries verified identity, device posture, and group context.

Identity-aware HTTP access

Authenticate users at the request layer — every request to internal apps carries verified identity, device posture, and group context.

HTTPS support

Auto-provision SSL certificates for internal web pages, because why should they be less secure than the public Internet?

HTTPS support

Auto-provision SSL certificates for internal web pages, because why should they be less secure than the public Internet?

Attribute-based (ABAC) policies

From user identity to device posture and location, build granular dynamic policies based on real-time user, device, and request data.

Attribute-based (ABAC) policies

From user identity to device posture and location, build granular dynamic policies based on real-time user, device, and request data.

Full request auditing

Every HTTP call attributed to a real human, with method, path, status, and latency. Replayable from your own log store, not a vendor black box.

Full request auditing

Every HTTP call attributed to a real human, with method, path, status, and latency. Replayable from your own log store, not a vendor black box.

One control plane. Every privileged session.

1

User authenticates

Engineer signs in once via your IdP. Device posture, group, and context are evaluated continuously.

2

Gateway brokers identity

A Layer‑7 reverse proxy inside your environment receives the request, validates policy, and propagates the user's identity downstream.

3

Short‑lived cert issued

For SSH and Kubernetes, a per‑session certificate is minted with the precise scopes the policy allows.

4

Session is recorded

Activity streams to your storage in asciicast v2 — replayable, attributed, ready for audit and incident response.

Frequently Asked Questions

What is Twingate Identity Firewall, and how is it different from a traditional firewall?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

Will my developers have to change how they work?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

How does Twingate handle SSH access without distributing SSH keys?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

How does Twingate Identity Firewall protect Kubernetes environments?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

Where is session recording data stored? Does Twingate have access to it?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

How does this compare to traditional Privileged Access Management (PAM) tools?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

Does Twingate Identity Firewall work with our existing identity provider?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

What protocols does Twingate Identity Firewall support?

Twingate can be set up in 15 minutes or less. Resources on networks can be secured with our one-line Docker deployment in minutes.

Frequently Asked Questions