Demos
Ambient credentials still authorize from anywhere until someone rotates them. A live cloud host, client, and server prove a single request in front of you so a developer, a sysadmin, or a business reader can decide whether to try ENI6MA against a service they care about.
One request, one envelope, one verdict
The stack you are about to see runs a news-poll API on a public host. The caller assembles an envelope (a one-time cryptographic authorization for a single request, replacing the reusable bearer token or API key), Gate (the enforcement component: a reverse proxy, SDK middleware, MCP wrapper, or sidecar that sits between callers and a protected route and requires a valid envelope for each request) intercepts the call in front of /api/news/poll, the nonce ledger (a durable append-only log that hands out single-use request tokens and records the moment each one is spent) records the request as spent under burn-before-validate (the ledger records the nonce as spent before the cryptographic proof is checked, so a captured request cannot be re-submitted even if validation later rejects it), and the compiled twin (the per-identity binary a workload runs to prove itself, produced by the Foundry minting appliance) is checked before the protected endpoint returns any data. The guided security tour is the primary path; the Pass+ ceremony is a secondary teaching UI aimed at people learning why the mechanism works at all.
If you run an API gateway, a service mesh, or a WAF today, ENI6MA replaces the authorization layer (Bearer tokens, API keys, long-lived JWTs). It coexists with authentication (OIDC, SAML, mTLS) and sits behind an existing reverse proxy, API gateway, service mesh, or WAF.
The path of one request
Each step below jumps you into the guided tour at the moment that stage happens on the wire. Read them in order the first time; the point of the demo is that every stage is load-bearing and none of them can be skipped.
Single-request proof path
Host to Client to Server to Burn to Validate single-request path
- 1. HostThe public site that puts a protected endpoint (a single API route placed behind Gate) on the internet.
- 2. ClientThe caller assembles an envelope (a one-time cryptographic authorization for a single request, replacing the reusable bearer token or API key) for one specific POST.
- 3. ServerGate (the enforcement component: a reverse proxy, SDK middleware, MCP wrapper, or sidecar that sits between callers and a protected route) receives the envelope in front of /api/news/poll.
- 4. BurnThe nonce ledger (a durable append-only log that hands out single-use request tokens and records the moment each one is spent) marks the request spent before any cryptographic check runs.
- 5. ValidateThe proof is checked against the compiled twin (the per-identity binary a workload runs to prove itself, produced by the Foundry minting appliance); on success the protected endpoint runs.
What Gate does on every call
Gate runs the gate order (the fixed eight-stage sequence of checks Gate runs on every untrusted request before application logic executes) below on every request before any of your code runs. The diagram is the same one used in the news-poll walkthrough; on that page it lights up per stage as the transcript advances.
Gate order
- 01
Request hash
Recompute digests; reject on mismatch
- 02
Endpoint
endpoint_id matches server constant
- 03
Policy
policy_hash from server POLICY_STRING
- 04
Anchor
Circuit handle active in registry
- 05
Freshness
tau within the call window
- 06
Burn nonce
Spend before twin validation
- 07
Validate
Twin proof check (local or registry)
- 08
Serve
Application policy, then resource
Happy-path envelope accept
Happy-path envelope accept through challenge respond burn allow
Where to go next
Each walk below is self-contained. A developer evaluating an integration should start with the gate walkthrough; a sysadmin doing threat modelling should start with Verify; an investor or a business reader who wants the mental model in two minutes should start with the Pass+ ceremony.
Security guided tour
A click-through of the live cloud host, client, and server exchanging a single envelope. Expect hotspots you can hover, the exact JSON payload on the wire, and the eight-stage decision the server made. Plan on about ten minutes end-to-end.
Gate walkthrough (news-poll demo)
A REST-shaped news-poll API sitting behind Gate. You will see the successful allow path once, then every reject stage the gate can emit when an attacker retargets, tampers, replays, or stalls the request.
Foundry minting walkthrough
How Foundry (the minting appliance that manufactures per-identity circuit binaries in cohorts) turns a recipe into a batch of per-identity binaries and hands them off to Control (the control plane: a registry of active identities plus the durable nonce ledger).
Verify attack suite
Verify (a customer-runnable attack suite that exercises a Gate deployment with adversarial traffic before real users do) run against the demo Gate, with the exact commands and expected pass criteria so you can point it at your own deployment.
Pass+ ceremony (teaching UI)
A visual walk through the human side of Pass+ (the human ceremony client that produces a request-bound proof without leaving a reusable secret behind, similar in spirit to how a hardware security key finishes a WebAuthn ceremony). Six public zones, six private bearings, one verdict after six witnesses. About two minutes.