Smallstep

Smallstep is a device identity platform that replaces static credentials with hardware-backed, short-lived certificates, covering access for humans, devices, workloads, AI agents and MCP-based toolchains. Its stated target is API key sprawl, and the framing is precise: the goal is to prove what is acting and from where, rather than merely to check that a valid secret was presented.

That distinction is the whole argument for certificate-based identity over API keys. A static key proves only that whoever holds it copied it successfully, and keys leak into repositories, logs, CI configuration and laptops without any signal that they have. A short-lived certificate bound to hardware proves which machine is making the request, and expires before a leaked copy is worth stealing.

ACME Device Attestation is the vendor's most substantial technical contribution and the reason to take the product seriously. Smallstep co-developed the standard with Google at the IETF as an upgrade to SCEP, using hardware co-processors for attestation and key binding, described as a fingerprint for the device, to prevent credential exfiltration, phishing and impersonation. Building and standardising a protocol rather than shipping a proprietary mechanism is a meaningful signal about the engineering behind a security product.

AI and MCP security is the current emphasis. Named capabilities cover securing non-human access including MCP clients and servers with cryptographic identity, authenticating AI workloads and MCP servers with mTLS instead of static secrets, and restricting AI and MCP access to trusted hardware. That focus is timely rather than opportunistic, since AI agents act without human oversight and an agent holding a long-lived API key is an unsupervised process with permanent credentials.

Device-bound access is the capability that distinguishes this from conventional certificate management: restricting access to specific trusted hardware means a stolen credential is useless off the device it was issued to. Pricing is not published; demos can be booked.