Standard interfaces. Nothing heavy to install.

Use Roost from Java, from any PKCS#11 client, or with a plain HTTPS call. Start on the simulator, which runs the same rules as the appliance.

Request a demo Read the docs

Start here

Pick your way in.

Quick start

Run three simulated voters and a quorum on your laptop, then sign.

Java (JCA)

A standard Signature provider for Java 17 and later.

PKCS#11

One module file for Linux PKCS#11 clients.

HTTPS gateway

Two calls: /v1/sign and /v1/verify.

Java

Sign in a few lines.

The provider hashes your message with SHA-256, asks the quorum to seal it and returns a receipt you can verify later.

Java guide

var provider = new RoostProvider(URI.create("https://roost-gateway.example"));
var signature = Signature.getInstance(RoostProvider.ALGORITHM, provider);
signature.initSign(provider.signingKey("release-ledger"));
signature.update(message);
byte[] receipt = signature.sign();

Built for operations

What developers and operators get.

Same API and the same policy code on the simulator and on the appliance: a test that passes here passes in production
Reasons on every refusal, not just an error number, and what would allow the request
One module file and one address; the module enrolls with the box on first use
Mutual TLS to the gateway on port 443, nothing else to open
Temporary partitions for CI that expire on their own
Status, alerts and audit records over syslog and SNMPv3, with the audit record id on every line

Diagnostics

When something fails, one command says what.

roost check walks from the network to the box and stops at the first problem with what to fix. The same result shows in the console for operators.

axowl.com/dashboard/acme/roost/diagnostics

AxowlacmeRoostM

Diagnostics · roost check from orders-api host

#	Step	Result
1	Network	roost-a.example:443 reachable	ok
2	Trust	box identity ROOST-26-0001 verified · attestation match	ok
3	Partition	prod visible	ok
4	Login	acme/orders-api · credential renews in 12 min	ok
5	Box	3/3 voters · armed · NTS 8 ms	ok
6	Sign	test seal on prod	ok

Evidence bundle Measure (bench)

Diagnostics: one command walks from the network to the box and stops at the first problem.

See Roost refuse an unapproved signature.

A 30-minute live demo with our engineers.

Request a demo