Documentation
Vouch replaces the static secrets your team manages today — AWS access keys, SSH keys, GitHub PATs, registry passwords — with short-lived credentials backed by a YubiKey. One tap, up to 8 hours of access, full audit trail.
New to Vouch? Start with the Getting Started guide to install the CLI and enroll your YubiKey.
Choose your path
For developers
Install the CLI, enroll your YubiKey, and verify your first hardware-backed session.
For admins
Configure organization settings, identity lifecycle, SAML, and device posture policies.
For security review
Review the credential lifecycle, trust boundaries, failure modes, and migration path.
Security · Threat model · Architecture · Availability · Migration
For DevOps and platform teams
Roll Vouch out to a growing team — AWS, EKS, CodeCommit, CodeArtifact, and more, without becoming the bottleneck.
Start here
Choose the fastest path for your first Vouch rollout.
Team Rollout
The playbook for giving a growing team access to AWS, EKS, CodeCommit, CodeArtifact, and more — without becoming the bottleneck.
Startups
Skip IAM users, access keys, and IAM Identity Center. Go from Google Workspace to AWS in minutes with OIDC federation.
Getting Started
Install the Vouch CLI, enroll your YubiKey, and replace static secrets with hardware-backed credentials in minutes.
AWS
One OIDC provider and one role unlock STS, EKS, CodeCommit, CodeArtifact, SSM, databases, Bedrock, and IaC tooling.
AWS
Stop distributing long-lived AWS access keys. Use OIDC federation to get temporary STS credentials backed by a YubiKey.
AWS Multi-Account
Deploy Vouch OIDC federation across multiple AWS accounts with Organizations, StackSets, and SCPs.
Amazon EKS
Access EKS clusters using OIDC-federated IAM credentials instead of long-lived kubeconfig tokens.
AWS CodeCommit
Clone and push to AWS CodeCommit repositories using short-lived credentials instead of HTTPS Git credentials or SSH keys.
AWS CodeArtifact
Pull and publish packages from AWS CodeArtifact using hardware-backed credentials — no token files, no refresh scripts.
AWS Systems Manager
Use AWS Systems Manager Session Manager with Vouch credentials to reach EC2 instances without opening SSH ports.
Databases
Replace static database passwords with 15-minute IAM auth tokens generated from hardware-backed credentials.
Amazon Bedrock
Connect to Amazon Bedrock foundation models using short-lived credentials with full audit trails.
Infrastructure as Code
Run CDK, Terraform, SAM, and other IaC tools using short-lived AWS credentials from Vouch.
CI/CD
Require a YubiKey tap before production deployments — hardware-verified identity embedded in every CI/CD credential.
Integrations
Authenticate to SSH, GitHub, container registries, package managers, Kubernetes, and AI APIs with the same YubiKey-backed session.
SSH Certificates
Eliminate authorized_keys management. Vouch issues SSH certificates that expire in 8 hours — no key distribution, no offboarding checklist.
GitHub
Replace GitHub PATs with short-lived tokens generated from your hardware-backed Vouch session.
Docker Registries
Stop running docker login and storing plaintext credentials. Vouch generates registry tokens on demand for ECR and GHCR.
Cargo
Use Vouch as a Cargo credential provider for private registries — no tokens in .cargo/config.toml.
Kubernetes
Access any Kubernetes cluster using OIDC tokens from Vouch — no cloud-specific plugins required.
SPIFFE
Connect hardware-verified developer identity to SPIFFE workload identity — federate Vouch OIDC tokens with SPIRE for zero-trust infrastructure.
Claude & OpenAI APIs
Use Vouch as the OIDC issuer for Anthropic and OpenAI Workload Identity Federation, so local development and one-off scripts don't need a long-lived sk-ant- or sk- key.
Operate Vouch
Manage users, identity providers, device posture, application sign-in, and deployment approval workflows.
Applications (OIDC)
Integrate Vouch as an OIDC provider in your web, SPA, or native app for hardware-verified authentication.
Admin Dashboard
Manage organization members, view audit logs, configure SCIM tokens, and enforce device posture policies from the Vouch admin dashboard.
SCIM Provisioning
Sync users and groups from your identity provider to Vouch automatically using SCIM 2.0.
Device Posture
Enforce security requirements on developer devices before issuing credentials — disk encryption, firewalls, screen lock, endpoint protection, and more.
SAML
Use SAML 2.0 identity providers with Vouch — Microsoft Entra ID, Google Workspace, and more.
Evaluate security
Review the architecture, threat model, availability behavior, migration approach, FAQ, and CLI reference.
CLI Reference
Complete command reference for the Vouch CLI — login, credentials, setup, and configuration.
Architecture
System components, protocols, and trust boundaries — how the Vouch CLI, agent, and server work together.
Security
How Vouch protects credentials at every layer — data flow, threat model, credential lifecycle, and supply chain integrity.
Threat Model
STRIDE-based threat analysis — threat actors, trust boundaries, assumptions, threats, and mitigations for the Vouch credential broker.
Availability
What happens when the Vouch server is unreachable — offline behavior, credential expiry, and blast radius.
Migration
Migrate from static credentials to Vouch — phased rollout, integration-by-integration checklist, and rollback plan.
FAQ
Common questions about Vouch — supported hardware, session behavior, platform support, and cost.