ultikeyd

Encryption-at-rest key custody

Sign in

Approve cold unseals with OTP. Share A never leaves this host in the clear.

6-digit TOTP, or a one-time recovery code.

Step 1 of 2

Set up authenticator

Scan the QR code, or enter the secret manually. Confirm with a live code before continuing.

TOTP QR code
Manual secret
Open in authenticator

Step 2 of 2 · save now

Recovery codes

Shown once. Store offline — each code works a single time if you lose your authenticator.

    Separate from suite data plane · OTP on every cold unseal

    ultikeyd

    Custody console

    Brave detected — Google push is off by default, so Enable push fails even with no adblocker. Open brave://settings/privacy → enable Use Google services for push messaging, reload this page, try again. Or use Firefox / real Chrome. 
    
      
    

      
    
        
    
          
    
            
    Pending unseal
    
            
    Cold start / lease expired — OTP required to release Share A.
    
          
    
          0
        
    
        
    
        
    No pending requests. Warm leases renew without OTP.
    
      
    

      
    
        
    
          
    
            
    Vaults & nodes
    
          
    
          
    
            
    
              
    VaultNodeLabel
    
              
            
    
            
    No enrolled nodes yet.
    
          
    
        
    
        
    
          
    
            
    Active leases
    
          
    
          
    
            
    
              
    LeaseNodeExpires
    
              
            
    
            
    No active leases.
    
          
    
        
    
      
    

      
    
        
    
          
    Audit log
    
          Last 100 events
        
    
        
    
          
    
            
    WhenActorActionDetail
    
            
          
    
          
    No audit events yet.