Zero Trust Workload Connectivity
OpenZiti is the open-source Zero Trust networking platform from NetFoundry that makes your services invisible.
# OpenZiti: embed zero-trust connectivity directly in your Python app
#
# Replace the identity path and service name with your own OpenZiti values.
import openziti
IDENTITY_FILE = "/secure/path/to/my-identity.json"
SERVICE_NAME = "private-api"
# Load an enrolled OpenZiti identity.
ziti = openziti.load(IDENTITY_FILE)
# Connect to a named Ziti service—not an IP address or public hostname.
with ziti.connect(SERVICE_NAME) as conn:
conn.sendall(
b"GET /health HTTP/1.1\r\n"
b"Host: private-api\r\n"
b"Connection: close\r\n\r\n"
)
response = b""
while chunk := conn.recv(4096):
response += chunk
print(response.decode("utf-8", errors="replace"))package main
import (
"fmt"
"io"
"log"
"github.com/openziti/sdk-golang/ziti"
)
func main() {
const identityFile = "/secure/path/to/identity.json"
const serviceName = "private-api"
config, err := ziti.NewConfigFromFile(identityFile)
if err != nil {
log.Fatal(err)
}
ztx, err := ziti.NewContext(config)
if err != nil {
log.Fatal(err)
}
conn, err := ztx.Dial(serviceName)
if err != nil {
log.Fatal(err)
}
defer conn.Close()
_, _ = conn.Write([]byte(
"GET /health HTTP/1.1\r\nHost: private-api\r\nConnection: close\r\n\r\n",
))
body, err := io.ReadAll(conn)
if err != nil {
log.Fatal(err)
}
fmt.Print(string(body))
}import org.openziti.Ziti;
import org.openziti.ZitiContext;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;
import java.nio.charset.StandardCharsets;
public class ZitiClient {
public static void main(String[] args) throws Exception {
String identityFile = "/secure/path/to/identity.json";
String serviceName = "private-api";
ZitiContext ziti = Ziti.newContext(identityFile);
try (Socket conn = ziti.open(serviceName);
OutputStream out = conn.getOutputStream();
InputStream in = conn.getInputStream()) {
out.write((
"GET /health HTTP/1.1\r\n" +
"Host: private-api\r\n" +
"Connection: close\r\n\r\n"
).getBytes(StandardCharsets.UTF_8));
out.flush();
System.out.print(new String(in.readAllBytes(), StandardCharsets.UTF_8));
}
}
}import ziti from "@openziti/ziti-sdk-nodejs";
const identityFile = "/secure/path/to/identity.json";
const serviceName = "private-api";
await ziti.init(identityFile);
ziti.httpRequest(
serviceName,
undefined, // No conventional scheme/host/port
"GET",
"/health",
["Accept: application/json"],
undefined,
undefined,
(response) => {
console.log(response.body.toString("utf8"));
}
);using System;
using System.IO;
using System.Threading.Tasks;
using OpenZiti;
public class ZitiClient
{
public static async Task Main()
{
const string identityFile = "/secure/path/to/identity.json";
const string serviceName = "private-api";
var ziti = await ZitiContext.Create(identityFile);
using var connection = await ziti.Dial(serviceName);
using var writer = new StreamWriter(connection) { AutoFlush = true };
using var reader = new StreamReader(connection);
await writer.WriteAsync(
"GET /health HTTP/1.1\r\n" +
"Host: private-api\r\n" +
"Connection: close\r\n\r\n"
);
Console.WriteLine(await reader.ReadToEndAsync());
}
}#include <stdio.h>
#include <string.h>
#include <ziti/ziti.h>
static void on_connect(ziti_connection conn, int status) {
if (status != ZITI_OK) {
fprintf(stderr, "Ziti dial failed: %s\n", ziti_errorstr(status));
return;
}
const char *request =
"GET /health HTTP/1.1\r\n"
"Host: private-api\r\n"
"Connection: close\r\n\r\n";
ziti_write(conn, (const uint8_t *)request, strlen(request), NULL, NULL);
}
int main(void) {
const char *identity_file = "/secure/path/to/identity.json";
const char *service_name = "private-api";
ziti_context ztx;
int rc = ziti_load_config(&ztx, identity_file);
if (rc != ZITI_OK) {
fprintf(stderr, "Could not load identity: %s\n", ziti_errorstr(rc));
return 1;
}
ziti_connection conn;
ziti_conn_init(ztx, &conn, NULL);
ziti_dial(conn, service_name, on_connect, NULL);
ziti_run(ztx);
ziti_shutdown(ztx);
return 0;
}import Foundation
import Ziti
let identityFile = "/secure/path/to/identity.json"
let serviceName = "private-api"
let ziti = try ZitiContext(identity: identityFile)
let connection = try ziti.dial(serviceName)
let request = """
GET /health HTTP/1.1\r
Host: private-api\r
Connection: close\r
\r
"""
try connection.write(request.data(using: .utf8)!)
var response = Data()
while let chunk = try connection.read(maxLength: 4096), !chunk.isEmpty {
response.append(chunk)
}
print(String(decoding: response, as: UTF8.self))
connection.close()One Control Plane, an Encrypted Mesh Data Plane, and Outbound-Only Endpoints
Reachability is the vulnerability: anything an attacker can reach, they can probe, and given time, exploit. OpenZiti removes it.
A controller manages identity, policy, and network state. An encrypted mesh fabric of edge routers carries every session with end-to-end encryption, smart routing, and automatic failover. Clients and services alike dial outbound only, so nothing listens for inbound connections and there is no reachable attack surface.
The Controller enforces identity-based policy on every connection, establishing an encrypted path only after both sides mutually authenticate.
Existing applications reach the Fabric through lightweight tunnelers with no code changes, while new applications embed an SDK to connect directly for the strongest Zero Trust model.
One Platform, Many Ways to Connect
OpenZiti is a platform, not a single tool. Start with the core, then add the pieces that fit how you build, whether you embed an SDK, drop in a tunneler, or share a service in seconds.
Ziti
The heart of the platform: a controller that manages identity, policy, and network state, edge routers that form the encrypted mesh fabric, and a full command-line interface. Everything else builds on it.
Application SDKs
Build Zero Trust connectivity directly into your application in Go, C, C#/.NET, Python, Node.js, Java/Kotlin, or Swift, so the app dials services by identity and never opens a listening port.
Tunnelers
Lightweight tunneling clients bring existing applications onto the OpenZiti network with no code changes, across Linux, Windows, macOS, iOS, and Android.
zrok
A sharing and reverse-proxy platform built on OpenZiti for exposing services, files, and websites securely, whether you self-host it or use the free zrok.io service.
Ziti Console
A visual administration console for operating an OpenZiti network: manage identities, services, and policies, and watch the state of the overlay at a glance.
AI Gateways
Purpose-built gateways give AI assistants Zero Trust access to MCP tool servers and LLM providers, so agents reach only what they are authorized to reach.
Where Teams Put OpenZiti to Work
The same identity-first model solves connectivity problems that conventional networking treats as separate products.
AI Security
Give AI agents and MCP tool servers a cryptographic identity, so they dial out to only the tools and models they are authorized for, with nothing exposed inbound.
API Security
Take private APIs off the public internet. Only authenticated, authorized identities can reach them, and there is no endpoint left for the internet to probe.
VPN Replacement
Give people Zero Trust access to private resources without the flat-network blast radius that turns one stolen VPN credential into a full breach.
Site-to-Site Connectivity
Connect clouds, data centers, and edge sites over an encrypted mesh, with smart routing, automatic failover, and no public inbound anywhere.
OT and IoT Connectivity
Reach industrial and IoT devices without exposing them to the internet, and segment them down to the individual device by identity.
Microsegmentation
Segment by identity-based policy not network architecture, stopping lateral movement and limiting the blast radius.
Trusted Where Failure Isn’t an Option
OpenZiti is developed in the open, adopted worldwide, and carries 1B+ sessions/month of production traffic across global infrastructures today. The code that moves your data is inspectable, auditable, and free.
Start with OpenZiti.
Move to NetFoundry When You Are Ready to Scale.
Take on the operations yourself, or hand them to NetFoundry for a faster, easier path to production at scale. Every tier runs the same open-source OpenZiti software.
OpenZiti
Stand up your own controllers and edge routers, issue certificate-based identities to every user, service, and workload, and run services dark with no inbound ports. You own and run the OpenZiti Fabric, free under the Apache 2.0 license.
- Self-hosted and self-managed, with full control of the fabric
- Seven language SDKs and multi-OS tunnelers
- Quickstarts, Docker, and Helm for stand-up and upgrades
- Community support through Discourse, GitHub, and documentation
NetFoundry Self-Hosted
Use NetFoundry’s licensed management suite to run your own OpenZiti fabric. Purpose-built for regulated, air-gapped, and sovereign environments, it lets you control the infrastructure while NetFoundry’s tooling, support, and compliance evidence lighten the operational lift.
- NetFoundry management suite to accelerate and simplify deployment, orchestration, operation, and scaling
- 24×7 Enterprise support from the team that builds and maintains OpenZiti
- FIPS-compliant cryptography and post-quantum-ready encryption
- Controls pre-mapped to NIST 800-53 and 800-207 to speed RMF work
NetFoundry-Hosted
NetFoundry provisions and operates a dedicated OpenZiti fabric for you, in minutes, securing, managing, monitoring, and scaling it on your behalf. You build on the network instead of running it, backed by a contractual uptime SLA of up to 99.95%.
- Dedicated, global, isolated fabric provisioned in minutes
- 100+ points of presence across AWS, Azure, Google Cloud, and OCI
- Managed PKI, upgrades, backups, and proactive monitoring
- SOC 2 Type II report and pre-mapped evidence to accelerate ATO
- Up to 99.95% SLA
Want to learn alongside other builders? Join the Community →
OpenZiti, Answered
What is OpenZiti?
OpenZiti is an open source Zero Trust networking platform, created and maintained by NetFoundry and licensed under Apache 2.0. It gives every user, device, service, and workload an X.509 certificate identity, then authenticates and authorizes each connection by identity before any network path exists. Services run with no inbound ports, endpoints dial outbound only, and traffic is encrypted end to end.
How does OpenZiti work?
A controller manages identity, policy, and network state. An encrypted mesh fabric of edge routers carries every session with smart routing and automatic failover. Clients and services dial outbound only and are authorized by identity before a path is built, so nothing listens for inbound connections and there is no reachable attack surface.
What is included in the OpenZiti ecosystem?
The core Ziti project provides the controller, edge routers, and command-line interface. Around it sit SDKs for seven languages, multi-OS tunnelers for applications you cannot modify, zrok for secure sharing, the Ziti Console for administration, and gateways that give AI agents Zero Trust access to MCP tool servers and LLM providers.
What can I build with OpenZiti, and is it really free?
OpenZiti is free and open source under the Apache 2.0 license, and you can run it in production at no license cost. Teams use it to secure AI agents and APIs, replace VPNs, connect sites, reach operational technology and IoT devices, and embed Zero Trust connectivity directly into products. You embed a language SDK for new applications, or use a tunneler for applications you cannot change.
Does OpenZiti require opening inbound firewall ports?
No. OpenZiti connections are outbound-only from every endpoint, which means you open no inbound firewall ports, publish no public IP addresses, and run no listening services for attackers to find. Authentication and authorization complete before any routable path is created, and your firewalls can enforce a single deny-all inbound policy.
How does OpenZiti relate to NetFoundry, and when should I move to the commercial platform?
NetFoundry created and maintains OpenZiti, and its commercial platform is built on the same open source code. Run OpenZiti yourself when you want full control and have the team to operate it. Move to NetFoundry Self-Hosted or NetFoundry-Hosted when production demands — scaling, monitoring, incident response, coordinated upgrades, compliance attestation, and a contractual uptime commitment — start to compete with running your business.
Ready to Secure Services, Not IPs?
Stand up the open-source platform today, or let NetFoundry run it for you at production scale.