Rekey

Auth for your MCP server. Billing for what your agent spends.

The OAuth 2.1 authorization server an MCP client expects (discovery, dynamic registration, PKCE), plus the credits, quotas, and licences your agent bills against.

An agent that signs your users in and moves their balance is the last thing worth renting from someone else. Rekey is MIT licensed, self-hostable, and the Postgres is yours.

Get started, $99/monthOr self-host it free

No per-MAU meter · MIT licensed · the source is on GitHub

Rekey.dev - Auth for your MCP server, billing for what your agent spends | Product HuntJoin Discord

Connecting an agent? Read the MCP guide

Application register · one book, both halvescredits, in the customer's own Postgres
01end_user.created[email protected]role: default, enforced1,500
02mcp.consentClaude Code · get_creditsPKCE S256 · RFC 75911,500
03usage.recordtool callswithin included quota1,460
04credits.consumemodel tokensatomic · idempotent0
05credits.consumemodel tokens402 payment_required0
The balance never goes negative. The call stops instead.402 · never a negative balance

  1. The agent spends, and nothing counts it

    Tokens, tool calls, third-party credits: every run burns some. Wiring a meter to a subscription so the spend actually stops at the plan's limit, instead of arriving as a surprise, is work nobody scoped.

    charged toyour margin

  2. MCP clients want a real authorization server

    Metadata discovery, dynamic client registration, PKCE. A strict connector fails if any one of them is missing, and the error it shows the user rarely says which. Building that is a detour from what you were making.

    charged toyour roadmap

  3. Two systems, two records of the same user

    The auth side knows who logged in. The billing side knows who paid. Webhooks land out of order, and the reconciliation code that keeps the two agreeing is yours to write and yours to debug.

    charged toyour on-call

  4. It holds credentials and it moves money

    An agent signs your users in and spends their balance. Putting that, and the record of who those users are, inside someone else's database is the trade people are least willing to make.

    charged toyour customers' trust

Meter what a run costs, and stop at the limit

Credits debit atomically. A spend past zero returns 402 rather than a negative balance. Usage meters carry an included quota per plan, and a record over the cap is refused, not quietly billed. Track whatever the run actually burns: model tokens, tool calls, MB ingested.

POST /api/v1/credits/consume

One tenant model for identity and entitlements

A Tenant owns one or more Applications. Login and subscription state share that model: access checks read the record that payment webhooks write, so there's no second copy to drift. Every row carries applicationId.

every row carries applicationId

Bring your own payment processor

Stripe, PayPal, and Razorpay sit behind one BillingProvider interface, set per Application. You change a config value, not your billing code. Provider-specific fields live in metadata.

BillingProvider, per Application

One command to self-host

docker compose --profile full up boots the API, Postgres, Redis, the operator panel, and the customer portal. The same build runs in production, and the Postgres is yours.

docker compose --profile full up
See the full architecture in the docs
End-user toolsread-only, scoped to one account4
Operator tools11 read · 13 write24
RFCs served8414 · 9728 · 7591 · 7636 · 76625

Your users' agent reads their own account

Turn MCP on for an Application and its end-users can connect Claude, Claude Code, or Cursor and see their own account: get_profile, get_subscription, get_credits, list_licenses. Four tools, all read-only, scoped to the one account that signed in: no licence keys returned, no way to reach another user. Off by default; you enable it per Application in the panel.

Your agent runs the workspace

The operator MCP has 24 tools: 11 read, 13 write. Read metrics and recent payments, create an Application, add a plan, configure a billing provider, cancel a subscription. Writes need an explicit write scope (mcp:operator:write over OAuth, or applications:write on a personal access token) plus an owner or admin role, and the two that touch money or provider credentials need mcp:operator:admin on top. A credential without the scope never sees the tool in tools/list, and membership is re-checked from the database on every call rather than read off the token.

Or put your own MCP server behind it

Running your own tools? Point them at Rekey's authorization server and validate the tokens it issues with one introspection call: rekey.mcp.introspect() in the Node SDK, RFC 7662 on the wire, authenticated with your Application's secret key. Sign-in, MFA, and revocation come with it, and you don't write an OAuth server.

Served, not planned
  • RFC 8414 authorization server metadata, suffix and path-insertion forms
  • RFC 9728 protected resource metadata, on the 401 too
  • RFC 7591 dynamic client registration
  • PKCE required, S256 only. plain is rejected
  • RFC 7662 token introspection

Discovery is served in both the suffix and the path-insertion form, because strict connectors ask for the second one and fail quietly without it.

Read the MCP guide
A real browser session against a real stack, cut to the parts that matter, every wait you can see is a wait the product actually took.

  1. Sign in to the operator panel

    One operator account, one workspace, no install step before this.

  2. Create an Application

    Name, slug, environment. Its own users, keys, auth config and billing.

  3. Mint a server API key

    Shown once, then only a SHA-256 hash is kept. Blurred on camera.

  4. Configure auth and redirect URLs

    Email + password, magic link, and the callback your app returns to.

  5. Prove it works

    Three SDK calls with the key just minted read everything back.

Watch the full version with narration or read the same walkthrough with a screenshot of every page.

Auth8 entries
  • Email + password (argon2id)
  • OAuth: Google, GitHub, Microsoft, Discord, GitLab, and Slack, plus any OIDC provider
  • MFA with TOTP + one-time backup codes
  • Refresh-token rotation with reuse detection. A replayed token revokes every session
  • End-user roles per Application (RBAC) with default-role enforcement
  • Session listing and revocation, including sign-out-everywhere
  • JWKS endpoint + opt-in RS256, verifying tokens offline on your own server, no API round-trip
  • Passkeys / WebAuthn: the API and SDK are built, but there is no way to switch them on yet. See the FAQ
Billing10 entries
  • Subscription, License, Usage, and Credit plan kinds
  • Stripe, PayPal, and Razorpay all live behind one interface
  • BYO provider credentials per Application (AES-256-GCM at rest)
  • Customer self-service portal: subscriptions, payments, and cancellation
  • Revenue dashboard: MRR, churn, and a 12-month trend per Application
  • Automatic dunning: scheduled failed-payment reminders + recovery tracking
  • Applications carry an environment (production, staging, or development); separate Applications keep real customers and rehearsals apart
  • Geographic routing across providers
  • Webhook receipts persisted + replayable from the panel
  • Coupons + discounts live; trials and proration are planned, not built
Credits, usage & licenses7 entries
  • Track any metric: model tokens, tool calls, API calls, MB ingested
  • Included quota per plan, enforced. A record over the cap is refused with 402, not billed as overage
  • Credit balances debited atomically and idempotently; a spend past zero returns 402, never a negative balance
  • Credits and quotas can pool to an organization, not just a single user
  • License keys issued on plan activation, validated by SDK; seat allocation is atomic
  • Per-Application meter definitions with units + aggregation, and a real-time meter dashboard in the panel
  • Per-user GDPR/DSAR JSON export + audit-log CSV export live; bulk user export planned
Developer experience11 entries
  • Typed SDKs: @rekey.dev/node, @rekey.dev/react, @rekey.dev/nextjs
  • Operator MCP to run your workspace from an agent: 24 tools, 11 read and 13 write, behind scoped OAuth consent and an owner/admin role floor
  • Read-only end-user MCP over OAuth 2.1: four account tools, off until you enable it per Application in the panel
  • Put your own MCP server behind Rekey auth, via RFC 7662 introspection via rekey.mcp.introspect()
  • @rekey.dev/cli: non-interactive, --json everywhere
  • Every error carries code, message, and fix:
  • Idempotency-Key on the money paths (credits, usage, checkout, and cancellation), so a retry never double-charges
  • A typed catalog of auth, billing, and dunning webhook events with a signature-verification helper
  • Per-application team roles: admin, billing-manager, and viewer grants for workspace members
  • OpenAPI spec served at /docs on every running instance
  • Operator panel built in Next.js, with a Cmd+K palette, onboarding checklist, audit-log CSV export

Lines in red are limits, not features. They are here on purpose.

The Postgres is yours. Auth and billing data never leaves your infrastructure.
your DATABASE_URL
No per-MAU meter, and no feature held back from the free path.
MIT, all of it
The same build runs in dev and in production; deploy on a VPS or Dokploy.
docker-compose.prod.yml
Read the self-host guide
Verified against docker-compose.yml
# clone, fill the blanks the file marks CHANGE_ME
git clone github.com/rekey-dev/rekey
cd rekey && cp .env.example .env

# one profile, four services
docker compose --profile full up -d

api      127.0.0.1:3030
panel    127.0.0.1:3031
portal   127.0.0.1:3050
# plus postgres + redis on the compose network

Ports bind to loopback by default. Set BIND_ADDRESS to expose them.

Self-host

Run the whole stack yourself. Free forever, no feature held back.

Free/ forever
  • Build the stack from source with Docker Compose: API, panel, SDKs
  • Unlimited Applications, Tenants, end-users
  • Bring your own Postgres + Redis
  • Bring your own Stripe / PayPal / Razorpay keys
  • Community support on Discord and GitHub
  • MIT licensed

No per-MAU meter; the Postgres is yours

Read the self-host guide

Rekey Cloud

Recommended

The same product, run by us. One workspace, billed monthly. Development and staging applications are free and uncounted.

$99/ workspace / month
  • One production application per workspace
  • Unlimited development + staging applications
  • No per-MAU meter. Logins are not counted or billed
  • No per-seat fees. Invite the whole team
  • Operator MCP endpoint for your AI agents
  • We run the Postgres, the upgrades, and the infrastructure
  • Email support from the team

Billed per workspace, not per seat, not per login. Want a free trial first? Get in touch.

Get started, $99/month

Enterprise self-host

Self-host with a named support contact and roadmap input.

Custom/ annual contract
  • Everything in Self-host
  • Named support contact
  • Early access to in-flight modules
  • Roadmap input

For teams that need a named contact. On the roadmap, not built yet: SAML, LDAP, and SCIM.

Get in touch

Free to self-host (MIT licensed) · Rekey Cloud $99 USD per workspace / month · Cancel any time, and you keep everything until the end of the period you have paid for, then the workspace drops to the free ceiling. Nothing is deleted and no one is signed out. Payments are non-refundable except where the law requires otherwise.

Self-host, the SDKs on npm, and the API are available today, MIT licensed and free with no limits. Rekey Cloud is $99 per workspace per month for one production application, unlimited development and staging. After you subscribe you generate a workspace key on your account page and redeem it at panel.rekey.dev to create the workspace; it takes about a minute and the key is shown as soon as the payment confirms. Want a free trial on our infrastructure first, or enterprise terms? Get in touch and we'll arrange it. The license is settled: MIT.

Run your auth and billing. Don't rent them.

Closing balance

Point an MCP client at it, meter what a run costs, and keep the users and the balances in your own Postgres. Run it yourself, or read the source first. Want us to run it instead? That's Rekey Cloud, $99 per workspace per month.

Get started, $99/monthOr self-host it free

Rekey Cloud from $99/month per workspace · self-hosting is free under MIT

Rekey: auth, billing, and MCP for agent products