Choosing a client
Once you have a network, you'll need an OpenZiti-aware client to access it. There are two types of clients, and depending on your needs, you'll use either a tunneler or an SDK to securely access the network.
Choosing which type of client to use comes down to whether you can modify the application's source code. Use a tunneler to add zero trust to existing applications with no code changes. Use an SDK to embed zero trust directly into the application for the strongest security posture: the application holds its own identity and doesn't trust the host network. Both approaches provide authentication, authorization, and end-to-end encryption.
Tunnelers
A tunneler is purpose-built software designed to connect applications that are not OpenZiti-aware to the network.
SDK
If you are building a new application, you have a unique opportunity to choose to use one of the OpenZiti SDKs and create a truly zero trust application from the start. An OpenZiti SDK enables your application to discover and provide or connect to OpenZiti services directly, without an agent or proxy. The SDKs use the edge client API provided by the controller to authenticate and discover routers and services. Then, the SDK connects to the most responsive router and begins hosting or connecting to the OpenZiti service.