Skip to content
BILLETRequest early access

How it works

Authorize the connection. Never own the logon.

Billet is a control plane. It decides who may reach which desktop, mints a token that proves it, and gets out of the way of the pixels. This page is the whole mechanism, because an evaluator deserves to see it before a call, not during one.

The shape of a deployment

The rule the architecture is built on: assume the public internet sits between every component. The gateway, the relay, and the agent all live at customer sites, on other networks, in other companies. Nothing may assume the control plane and the desktop network share routing.

Where a Billet deployment runsEverything except the user runs on infrastructure the operator controls. Inside that boundary sit the Billet control plane, which handles SAML sign-in, SCIM provisioning and session brokering, and the relay or DCV gateway. Inside a further boundary, on a private network behind NAT, sit the GPU hosts. Users sign in to the control plane and receive a session grant, and their media flows to the relay. The hosts open outbound connections to the control plane to register and to the relay to carry media, so they need no inbound firewall rules. Sessions never route through Billet's own services.Your infrastructureYour usersBrowser, to sign inViewer, for the desktopCAD, Blender, DCCBillet control planePortal and session brokerSAML 2.0, per tenantSCIM 2.0 provisioningTenant isolationRelay or DCV gatewayOutbound-only rendezvousTCP where UDP is blockedPrivate network, behind NATGPU hostsWindows 11, NVENCNative Billet, or DCVNo inbound portssign in, grantmediaregistersoutboundThe hosts open connections outward. They never accept one.

The sequence

How a session gets brokered.

  1. 01

    A host registers

    The host agent opens a control connection outward and registers with its tenant, an enrollment secret, and the desktops it offers. It heartbeats from then on. Enrollment uses a one-shot register token and returns a durable, rotating credential, so nobody has to paste a long lived secret into a golden image.

  2. 02

    A user signs in

    The user hits the portal and is sent to their tenant's identity provider over SAML 2.0. A tenant can have more than one connection, so the login page can offer the right button rather than assuming one provider for everybody.

  3. 03

    Billet decides what they may reach

    The broker looks only at hosts inside that client's tenant, checks the per-client allowlist, checks the host is online and under capacity, and picks a codec. AV1 first where it is available.

  4. 04

    Billet mints a session

    It creates a session id and a media token, which is an HMAC over the session fields keyed by a broker secret. The token goes to the host over the host's live control connection, and to the client inside its grant. The token the client holds is byte for byte the token the host received.

  5. 05

    The media path authorizes itself

    The host compares the token the client presents against the one the broker relayed to it. The host never holds the signing key, so a compromised host cannot mint a session for itself or for anyone else.

Isolation

Two layers

The tenant boundary

Host lookup is scoped to the requesting client's tenant before anything else happens. A desktop in another tenant is not hidden from the response, it is never a candidate for it.

The per-client allowlist

Inside a tenant, a client can be restricted further to named desktops. Useful when one tenant covers a whole customer and you still want a contractor to reach exactly one machine.

On a bad link

Drop fast, recover slow.

The controller drops quality within one feedback interval and climbs back only after several clean intervals plus a cooldown. It reads three congestion signals: packet loss, a standing rise in round trip time over the learned baseline, which is what bufferbloat looks like, and measured goodput. That last one is the direct handle on a thin link: the target is clamped to the highest rung that fits inside measured goodput, so a client on a weak connection lands on a lower resolution instead of stuttering at a higher one.

Transport is selectable per route rather than chosen globally. QUIC earns its keep on lossy and mobile paths. On a clean, high latency, long haul route, well tuned TCP frequently wins on throughput and tail latency, so TCP stays a first class option rather than a fallback for networks that block UDP.

Restart durability

A restart is not an outage.

  • Minted sessions, the command queue and its results, agent-discovered session ids, outstanding SAML request ids, and the audit log are all tables.
  • A restart does not break an in-flight connect, lose an assignment, or erase the audit trail.
  • Only telemetry and thumbnails live in memory, and the agent re-sends both within one interval.

Want to see it against your own setup?

We are onboarding a small number of early access deployments.

Request early access