What Octet Provides
Octet runs the inference API and issues you the credentials the edge and your backend need — there's nothing for you to operate on Octet's side.
What runs on Octet's side
Octet operates the inference API: the service that turns the relayed signals into a verdict. All of that computation happens on Octet's infrastructure. It is never distributed, never sent to the browser, and — as you'll have noticed throughout these docs — never described here. That's the product boundary. See Trust & Privacy.
You don't provision, deploy, or operate anything on Octet's side. There are no "requirements on Octet's end" for you to satisfy beyond using the credentials below.
What Octet issues you
During onboarding, Octet provides:
| Item | Used where | For |
|---|---|---|
| License key | The edge (LICENSE) | Authorising the edge → Octet channel. |
| Partner key | Your backend (x-octet-partner-key) | Authorising verdict reads. |
| mTLS client certificate + key (planned) | The edge (EDGE_CLIENT_CERT_FILE / EDGE_CLIENT_KEY_FILE) | Mutual TLS to Octet — planned hardening, issued when enabled. |
| Octet CA certificate (planned) | The edge (OCTET_CA_FILE) | Pinning and verifying Octet for mutual TLS — planned hardening. |
| Octet API URL | The edge (OCTET_URL) and your backend | The endpoint the edge forwards to and your backend reads from. |
Mutual TLS for the edge → Octet channel (the two (planned) rows above) is hardening that is not yet in force; those certificates are provisioned when it's enabled. Current deployments don't require them.
What you provide
In return, the only infrastructure you run is the two logic-free pieces:
- The collector, served from your origin.
- The edge, on a Linux host that terminates the browser connection.
Plus a single server-to-server verdict read from your backend.
Onboarding-time coordination
Two things are worked out with Octet per partner, because they depend on your infrastructure:
- The exact connection-termination topology for the edge (so the connection-level timing signal is preserved). See Deploy the Edge.
- Issuance of the credentials above.
Where to go next
- Prerequisites. The full checklist.
- Licensing. The two keys in detail.