One-click offboarding for laptops, servers, apps and AI agents.
Enterprise-grade access control without enterprise IAM complexity. One action ends laptop unlock, SSH sessions, app sign-ins and security keys, and records it. Passwordless login for your team is included.
20-minute live demo · Reply the same business day · macOS, Windows and Linux
One identity per employee, for every laptop and server. Provision access in minutes, sign in with a fingerprint or security key, and offboard from one place. AI agents get their own scoped identities too.
Built on open standards
No proprietary protocol to take on faith.
FIDO2
Hardware-backed, phishing-resistant sign-in
WebAuthn
The W3C standard browsers implement
Passkeys
Synced or device-bound credentials
CTAP2
How security keys talk to devices
OpenSSH
The SSH client your team already uses
Works with macOS, Windows and Linux · Okta, Microsoft Entra ID and Google Workspace · SAML and OIDC apps · YubiKeyCompatibility
Why Bastyx
Enterprise-grade access control, without enterprise IAM.
Passwordless laptop login, short-lived SSH access, AI-agent controls and one-click offboarding, in one line item from $6 per user per month. It replaces an MFA tool, an SSH key process and an offboarding checklist.
Offboarding that actually ends access
One action ends laptop unlock, open SSH sessions, app sign-ins, security keys and AI-agent credentials. You know the contractor you let go has nothing left.
Passwordless beyond SSO
SSO-first MFA tools stop at web apps. Bastyx also covers laptop login and Linux servers, replacing long-lived SSH keys with short-lived access, without buying enterprise PAM.
Everything core on Starter, priced in public
Laptop login on macOS, Windows and Linux, SSH access, offboarding and the audit log are all on the $6 plan. No desktop-login upsell, no five-figure minimum, no sales call to see a price.
| What you get | Bastyx Starter | SSO-first MFA tools | Enterprise PAM |
|---|---|---|---|
| Passwordless app sign-in | Yes | Yes | Yes |
| Laptop login on macOS, Windows and Linux | Yes | Often a higher tier | Varies |
| Short-lived SSH access, no long-lived keys | Yes | No | Yes |
| One-click offboarding across laptops, servers and apps | Yes | Apps only | Servers only |
| AI-agent identities | Yes | No | Varies |
| Audit log | Yes | Yes | Yes |
| Pricing | $6 / user / month, published | Low per user, add-ons for desktop | Annual contracts, quote only |
Passwordless app sign-in
- Bastyx Starter
- Yes
- SSO-first MFA tools
- Yes
- Enterprise PAM
- Yes
Laptop login on macOS, Windows and Linux
- Bastyx Starter
- Yes
- SSO-first MFA tools
- Often a higher tier
- Enterprise PAM
- Varies
Short-lived SSH access, no long-lived keys
- Bastyx Starter
- Yes
- SSO-first MFA tools
- No
- Enterprise PAM
- Yes
One-click offboarding across laptops, servers and apps
- Bastyx Starter
- Yes
- SSO-first MFA tools
- Apps only
- Enterprise PAM
- Servers only
AI-agent identities
- Bastyx Starter
- Yes
- SSO-first MFA tools
- No
- Enterprise PAM
- Varies
Audit log
- Bastyx Starter
- Yes
- SSO-first MFA tools
- Yes
- Enterprise PAM
- Yes
Pricing
- Bastyx Starter
- $6 / user / month, published
- SSO-first MFA tools
- Low per user, add-ons for desktop
- Enterprise PAM
- Annual contracts, quote only
The problem
Access sprawls. Nobody sees all of it.
Credentials pile up across laptops, password managers, servers and cloud consoles. Security becomes a collection of disconnected systems, and offboarding becomes guesswork.
- 01
An employee leaves.
Which laptops, SSH keys, servers, cloud accounts and apps can they still reach? Most teams find out by searching.
- 02
A contractor gets an SSH key.
Who remembers to revoke it six months later? Static keys don’t expire, and they don’t say whose they are.
- 03
Strong authentication turns into a ritual.
Codes, prompts and VPN hops on every login. People find workarounds, and the workarounds become the risk.
What a manual access audit typically turns up. Example scenario.
How it works
Enroll. Grant. Control.
Three steps from new hire to full audit trail. No keys to copy, no passwords to hand out.
- 01
Enroll
Enroll the employee’s device. Register a passkey, security key or our fingerprint reader.
Enrollment checklist: person added, laptop enrolled, security key registered, USB-C fingerprint reader optional. - 02
Grant
Assign access to laptops, servers, apps and cloud roles by policy, or grant it for a fixed window.
A policy granting the Engineering team access to prod servers with a security key, plus a two-hour temporary grant. - 03
Control
Watch authentication events as they happen. Step up, approve or revoke access instantly.
Live events showing an allowed SSH login, a pending approval and a blocked cloud login, with a Revoke all action.
Every request takes the same path.
Passkeys, security keys and fingerprint readers are how people prove who they are. Bastyx is the control layer between people and what they access, and every decision ends in an audit event.
- EmployeeAlex Morgan
- IdentityOne identity, everywhere
- DeviceEnrolled and known
- AuthenticatorPasskey, key or fingerprint
- Bastyx policyAllow, step up or deny
- ResourceLaptop, SSH, cloud, app
- Audit eventWho, what, where, when
For engineering teams
SSH without SSH-key chaos.
Long-lived keys copied to servers are the hardest credentials to track and the easiest to forget. Bastyx replaces them with short-lived access tied to a person, a device and a policy.
Touch. Authenticate. Connect.
How Bastyx handles SSH accessNo authorized_keys to maintain
Access comes from policy, not from public keys copied onto every server.
Expires by default
Credentials are issued per session and expire on their own. Nothing to chase later.
Your client, your workflow
Works with the standard OpenSSH client and your existing config. Touch your key and connect.
Production access on request
Ask for elevated access for a fixed window. It’s approved in the flow and ends automatically.
Offboarding
Access should end when employment does.
Your developer left Friday. Their access ended Friday. One action closes their open SSH sessions, refuses their next laptop unlock and app sign-in, deregisters their security keys, and records every change.
Every access path in one view
Bastyx knows what each person can reach, so offboarding isn’t a search through five consoles.
Nothing left to rotate
No shared passwords or long-lived SSH keys means nothing behind them to chase after someone leaves.
Proof, not hope
An audit record shows what was revoked, when, and by whom. Useful for you, and for your next security review.
Clear boundaries
Access Bastyx doesn’t manage is listed as a manual step, not assumed. During an outage, new SSH and app sign-ins wait.
Revoke once. Every connected system follows.
AI agents
Every AI agent gets its own identity.
AI agents now deploy code, query databases and call internal APIs, usually with a person’s token or a shared service account. Bastyx gives each agent its own identity, a named owner, a policy and short-lived credentials.
How to set up agent identitiesIts own identity
No borrowed tokens. Logs show the agent and the person who owns it, never one posing as the other.
Short-lived by default
Credentials are issued per task and expire on their own. Nothing long-lived to leak from a prompt, a config file or a log.
A human approves what matters
Production changes and sensitive data wait for the owner’s approval, confirmed with a touch of their security key.
Stopped in one step
Pause or revoke an agent instantly. Offboarding a person also pauses the agents they own.
High-risk actions
The AI flags it. A passkey approves it.
Bastyx reads outgoing email and prompts to AI chatbots like ChatGPT, and flags anything that could expose important company data. The AI never sends or approves anything itself. It still comes down to authentication: when your policy says so, only the sender’s passkey can release it.
How high-risk action checks workThe AI notices
Customer data, secrets, source code or your own categories in an email or a ChatGPT prompt, before it’s sent.
Your policy decides
Allow, warn, require a passkey or block, per channel, team and AI tool. Rules you mark always apply.
A passkey confirms
Only the person, present on their own device, can release it. Malware, a stolen session or an agent can’t.
Every decision is recorded
Who, where, what was flagged and what they chose, in the same audit log as every sign-in. Not the content.
For MSPs
Offboard a client’s employee in one click.
Managing IT for small businesses? Give every client passwordless laptop and SSH access, and end a departing employee’s access everywhere with one action and an audit record to show for it.
Book a demo
No passwords. No SSH keys to chase. No access left behind.
Tell us what you’re securing. An engineer will show you Bastyx running against a setup like yours.
- 20 minutes, live: laptop login, SSH, offboarding and the audit log
- We reply with times the same business day
- A short form. No phone number, no sales sequence