Post-Quantum Application Security for FastAPI.

ML-KEM-768 and ML-DSA-65 are used in the server-side ODRE v3 boundary. Session, sequence, replay and authenticated request/response checks gate Protected Handler execution. Fail-Closed blocks the unverifiable request, not the whole server.

Quick startSecurity architecture
FastAPI integrationInstall the product with the platform installer, then import ODRE PQC and apply install(app).
Fail-ClosedUnverifiable protected requests stop before business handler execution.
Signed local updatesThe configured customer updater checks approved local input every 15 seconds. It validates signatures, integrity and compatibility before passing accepted input to the local AUM. This release does not download new releases from a central update server.
01

What ODRE PQC is

ODRE PQC is not a general-purpose cryptography toolkit. It composes runtime identity, a post-quantum handshake, session state, strict sequence handling, replay defense, request semantics, protected responses, and lifecycle controls into one FastAPI execution boundary.

Calling a post-quantum algorithm does not by itself determine whether the verified runtime was loaded or whether a replay can execute a business handler twice. The boundary turns those questions into conditions checked before protected code runs.

02

How it integrates

Existing clients → HTTPS/TLS → FastAPI → Gateway → ODRE v3 → Core → Protected Handler. Clients keep their API contract; ODRE v3 runs between Gateway and Core, not between mobile devices and the server.

Existing clientHTTPS / FastAPIGateway / ODRE v3Private CoreProtected Handler

Install the product with the platform installer. In FastAPI, import ODRE PQC and call install(app). Core, Native, Gateway, license and lease, session and replay, Fail-Closed, and the update lifecycle are managed inside ODRE.

Canonical FastAPI application integration

from fastapi import FastAPI
from odre_pqc import install

app = FastAPI()
install(app)

This is the canonical customer-facing application integration. Product installation remains a separate platform step, while ODRE manages its internal Core, Native, Gateway, and Commercial gate integration.

The customer owns the FastAPI application, protected routes and handlers, application authentication and authorization, business logic and DB, real protected-request validation, and Production approval. ODRE manages its internal security boundary and lifecycle.
03

Protected and public routes

Protected routes

A protected route executes only after the required security contract is satisfied. A malformed envelope, invalid session, duplicate or skipped sequence, semantic mismatch, or untrusted runtime state blocks handler entry.

Public routes

Public health or information routes may remain available according to application policy when protected routes are blocked. Fail-closed protection does not require every public route to stop.

04

Deployment and operational model

  • InstallVerify the customer archive and the independently approved verifier kit first. Install into a new protected immutable directory, then follow the RC2 Native installation guide.
  • initinit creates a Native device identity. Use it only for a new installation. Preserve existing identity, License, Unit, Lease and device state. Do not reinitialize an existing installation or copy private material to another device.
  • doctordoctor checks the signed runtime without activation.
  • verifyverify checks Core after existing Lease admission. Verify the actual Gateway → Core → Protected Handler path separately.
  • FastAPI integrationAfter product installation, import ODRE PQC and apply install(app). Configure protected routes and handlers plus application authentication and authorization; ODRE manages its internal Core, Native, Gateway, and lifecycle wiring.
  • statusstatus reads the Native state. Trial and Paid activation use the installed Native launcher and its approved local trust configuration.
Read operations guidance
05

Supported Platforms

EnvironmentSupported platformStatus
WindowsWindows Server 2022 AMD64Supported
LinuxUbuntu 22.04 AMD64Supported
LinuxUbuntu 24.04 AMD64Supported
LinuxDebian 12 AMD64Supported
LinuxRocky Linux 9 AMD64Supported
LinuxAlmaLinux 9 AMD64Supported

One Product / One Package · Automatic platform detection

Before installation

Verify the customer archive and the independently approved verifier kit first. Install into a new protected immutable directory, then follow the RC2 Native installation guide.

06

Protected traffic benchmark

Final benchmark results will be published only after the current server measurement and evidence review are complete.

Final benchmark evidence pending

Plain FastAPI, HTTPS FastAPI, and the ODRE PQC Protected Path are being compared in the same environment. Only approved final results will be published.

Next

Continue with documentation or licensing.

Use the documentation for installation and operations, or review Unit pricing and commercial terms.

Open documentationReview pricingReview evidence