01
Install the agent
The only command you'll ever run. It enrolls with a single-use token, generates its own keypair locally, and gets a client certificate back — the private key never leaves the machine.
Keyzo keeps authorized_keys in sync across your entire fleet.
Grant access in a click. Revoke it everywhere in seconds. And prove
exactly who could reach what — with an audit trail that breaks if anyone
quietly rewrites it.
Every server has its own authorized_keys. Nobody is quite sure what's
in all of them. That's fine — right up until the day it really, really isn't.
Someone leaves on Friday. Their key is on 40 boxes, or 400 — and the only way to know is to go look on each one.
Not quickly, not confidently, and not in a way you'd want to put in front of an auditor.
Your playbook removes the key on the next run. Revocation shouldn't have to wait for a cron window.
Contractor keys, laptop keys, that one "temporary" deploy key from 2019. All still perfectly valid.
Pick someone. Grant or revoke. Every host converges on the new state — and you
can watch a single host's authorized_keys rewrite itself as the wave hits it.
Sped up here; in production each host converges on its next check-in, inside the
30-second poll interval.
One command on each server. After that it's all browser — no client tooling to install, no config files to template, nothing for your team to learn before they can use it.
The only command you'll ever run. It enrolls with a single-use token, generates its own keypair locally, and gets a client certificate back — the private key never leaves the machine.
Register staff once, attach their public keys, and organise hosts into groups. Keyzo validates every key it accepts — no command= smuggling, no weak algorithms.
From the dashboard: grant access to a host, a group, or the whole fleet. Revoke it — or disable someone outright — and every agent drops the key on its next check-in.
The control plane never opens a connection into your fleet, never holds SSH credentials for it, and never needs a hole in your firewall. Agents dial out over mutual TLS and ask what the world should look like.
Agents just keep the last state they applied. Existing SSH access keeps working; you simply can't make changes until it's back.
Each agent renews its own client certificate about a month before expiry. No cron job, no calendar reminder, no 3am page.
Ship a new agent build and the fleet picks it up on its next poll — downloads, swaps itself out, and re-execs in place.
Every agent gets its own client certificate signed by an internal CA. The TLS stack verifies it during the handshake — a forged identity never reaches application code at all.
Keyzo holds no SSH keys, passwords, or sudo rights for your servers. Compromising the control plane doesn't hand anyone a shell on your fleet.
The agent rewrites the lines between two marker comments and nothing else. Your hand-added keys, your command= backup key, your comments — all survive every sync untouched.
Every change commits to the hash of the one before it. Edit or delete a historical row and the chain visibly breaks from that point forward — see for yourself below.
Files are written to a temp file, fsynced, then renamed into place. A concurrent sshd read sees the old file or the new one — never a half-written one.
Desired state is computed fresh on every poll from current grants. A revoked key simply stops appearing — there's no "removal job" to queue, retry, or lose.
Each entry's hash commits to the previous entry's hash. These are real SHA-256 digests, computed in your browser right now. Try rewriting history and watch the chain give you away.
Keyzo is opening up in waves. Tell us a little about your fleet and we'll get you a deployment and an invite code. We'd rather onboard a handful of teams properly than a thousand badly.
We'll be in touch when the next wave opens.